# Package Management Published articles for Package Management. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## kpt v1.0.0 is released DevFeed: [kpt v1.0.0 is released]() Original publisher: [Read original article]() Author: epower Published: 2026-11-05T12:00:00Z Content type: release Language: en Sources: [Cloud Native Computing Foundation]() Topics: [project release](), [configuration-management](), [Cloud](), [CI/CD]() Tags: [adoption](), [apis](), [applications](), [blog](), [cloud-native-applications](), [community](), [configuration](), [gitops](), [kubernetes](), [lifecycle](), [modular](), [package-management](), [release](), [stable](), [toolchain](), [v1]() ### AI overview The kpt community released version 1.0.0 after a year focused on stabilizing APIs, deprecating unused features, and bringing Porch back under common governance. The release marks the toolchain's readiness for wider adoption. Standalone kpt manages Kubernetes configuration packages using KRM and "config as data" principles: packages describe repeatable resource manipulation and validation, turning generic KRM into deployable models without templating. Porch adds orchestration for managing kpt packages at scale in zero-touch GitOps workflows. Together, the project aims to provide a modular framework for managing Kubernetes resource lifecycles. ### Source excerpt After many years and much development, the kpt community has released v1.0.0 of the kpt toolchain. This is a big step in maturing the kpt project after having it in pre-release status for several years. In... ## Cloudflares Newly Acquired Vite+ Reaches 1.0 with GitLab CI Support, Hooks, and tsup Migration DevFeed: [Cloudflares Newly Acquired Vite+ Reaches 1.0 with GitLab CI Support, Hooks, and tsup Migration]() Original publisher: [Read original article]() Author: Daniel Curtis Published: 2026-10-14T06:15:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [GitLab](), [pnpm]() Tags: [ci](), [ci-cd](), [cloudflare](), [cloudflare-viteplus-stable](), [developers](), [development](), [gitlab](), [gitlab-ci](), [hooks](), [javascript](), [news](), [package-management](), [typescript](), [web-development]() ### AI overview VoidZero has released Vite+ 1.0, a stable unified JavaScript toolchain that brings Node.js and package management together with frontend tools under one command and configuration file. The release adds GitLab CI support, Docker and Homebrew distribution, improved migration and diagnostic commands, and Git hook management. Planned additions include remote caching and deeper monorepo diagnostics. ### Source excerpt VoidZero has launched Vite+ 1.0, the first stable version of its JavaScript toolchain. It features a command line tool for managing Node.js, package management, and frontend development from a single configuration file. Enhancements include CI integration for GitLab and Docker support. Future updates are planned, focusing on stability and diagnostics. By Daniel Curtis ## Every package is already installed DevFeed: [Every package is already installed]() Original publisher: [Read original article]() Published: 2026-09-25T02:14:00Z Content type: article Language: en Sources: [Farid Zakaria's Blog]() Topics: [Nix](), [Package Management](), [file](), [Agent Harness]() Tags: [2026](), [agent-harness](), [configuration](), [filesystem](), [go](), [nix](), [nixpkgs](), [package-management](), [packages](), [shell]() ### AI overview The article introduces omnibin, a FUSE filesystem that exposes binaries from Nixpkgs on demand without installing packages or building them locally. It uses JSON metadata from Hydra and lazily fetches and unpacks archives from the Nix cache when files are accessed. ### Source excerpt tl;dr; omnibin is a FUSE filesystem that puts every binary nixpkgs ever shipped on your $PATH. Nothing is installed. Nothing needs building. 0 bytes on disk until something actually reads a file. 😈 It's 2026, why am I still installing packages individually?1 Why must I go through the ritual of adding a package to my configuration.nix, running nix-shell or succumb to the hellscape of nix-env -iA. Yes, I am a little inspired after watching DHH's keynote at RailsConf 2026. I feel the same way about package management. ↩ ## Restricting npm bypass-2FA granular access tokens DevFeed: [Restricting npm bypass-2FA granular access tokens]() Original publisher: [Read original article]() Author: Allison Published: 2026-07-31T16:45:50Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [npm security](), [npm](), [credential-based attacks](), [Secure token management](), [account takeover](), [least privilege]() Tags: [2fa](), [access-tokens](), [account](), [attack](), [automated](), [bypass](), [challenge](), [cli](), [community](), [deprecation](), [github](), [interactive](), [maintainers](), [manage](), [management](), [npm](), [oidc](), [org](), [package](), [package-management]() ### AI overview npm granular access tokens configured to bypass 2FA will no longer be able to manage tokens, package access and maintainers, trusted publishing, or organization and team membership; those actions will require an interactive 2FA challenge. Direct publishing with these tokens will also be removed, leaving private-package reads and staged publishing subject to maintainer approval with 2FA. npm targets January 2027. The change affects npm GATs only, not GitHub personal access tokens, GitHub App tokens, or Actions' `GITHUB_TOKEN`. The excerpt recommends moving automated publishing to trusted publishing (OIDC) or staged publishing. ### Source excerpt npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of... ## pnpm 11.10 DevFeed: [pnpm 11.10]() Original publisher: [Read original article]() Author: Zoltan Kochan Published: 2026-07-05T00:00:00Z Content type: release Language: en Sources: [pnpm]() Topics: [pnpm](), [Package Management](), [Continuous integration](), [Rust]() Tags: [authentication](), [ci](), [deploy](), [github-actions](), [node-js](), [package-management](), [pnpm](), [release](), [rust]() ### AI overview pnpm 11.10 adds CI-friendly registry authentication, new prefix and issues commands, and support for installing pnpm v12, a Rust-based port. The release also improves package resolution and hardens global package management and deployment-related workflows. ### Source excerpt pnpm 11.10 adds the _auth setting for CI-friendly registry authentication, new pnpm prefix and pnpm issues commands, and the ability for pnpm self-update to install pnpm v12 (the Rust port). It also improves pnpm up accuracy, speeds up resolution against registries that ignore abbreviated metadata, and hardens global package management, pnpm deploy, and pnpm pack-app. ## Week Notes 26#22 DevFeed: [Week Notes 26#22]() Original publisher: [Read original article]() Author: Jamie Tanna Published: 2026-05-31T20:03:16Z Content type: opinion Language: en Sources: [Jamie Tanna]() Topics: [npm](), [Package Management](), [Maven Central](), [Artificial Intelligence]() Tags: [ai](), [maven-central](), [npm](), [package-management](), [week-notes]() ### AI overview A personal week-notes entry covering work activities involving npm package publishing, Maven Central integrations, package-management discussions, a webinar, and AI-related conversations, alongside everyday life, gaming, and entertainment. ### Source excerpt A nice relaxed Bank Holiday Monday We spent the day mostly trying to hide from the heat - highs of ~32 made it rather toasty Glad I did the decking on Saturday/Sunday, as it was so toasty And playing Clair Obscur: Expedition 33 almost all the day - continuously until the game crashed in the evening 🫣 A pretty busy work week One very good thing is that we're back to being able to publish npm packages 🚀 Had a good chat with Brian about our integrations with Maven Central Enjoyed doing my first webinar at work Had some good AI-y discussions with Alan this week Cookie wasn't super happy in the heat and did a few grumbly barks at one point because she wasn't happy But it also wasn't super cute when she kept us up for most of Monday night - I ended up being awake 0400-0600 and when I couldn't get back to sleep, decided to get up and play some Clair Obscur: Expedition 33 before work Finding it surprisingly weird to stand while playing Clair Obscur: Expedition 33 (as it's with a controller) Joined the CHAOSS Package Management gang on Wednesday while walking Cookie which was nice, and got some good food for thought A nice pizza night and catch up with folks Cookie and Morph have been having a lot of fun this week watching out for the mice living in the wall in the garden, and one day Cookie missed it racing out of the bushes in the flower bed into a crack in the wall Had a nice breakfast at OK Diner with Carol and Alan A nice walk around Gravelly Hollow this morning, getting to the end just before the rain started (despite being told "there won't be any rain today" by the clever home assistants) While eating lunch today, Cookie was peeking through the bushes and watching us - I wish I could've got a photo quickly enough, but the memory will have to be enogh! Had a good day going through the various holiday booking bits 👀 Very exciting! Having a look at what it'd take to support standard.site on my blog Playing: Clair Obscur: Expedition 33 So very good - really enjoying the ## PowerShell PSResource Roadmap and Best Practices DevFeed: [PowerShell PSResource Roadmap and Best Practices]() Original publisher: [Read original article]() Author: Sydney Smith Published: 2026-05-20T20:56:10Z Content type: article Language: en Sources: [PowerShell Team]() Topics: [PowerShell](), [Package Management](), [Security](), [supply-chain-security](), [Automation](), [configuration](), [NuGet]() Tags: [automation](), [best-practices](), [enterprise](), [infrastructure](), [microsoft](), [nuget](), [package-management](), [powershell](), [security](), [supply-chain]() ### AI overview PowerShell PSResourceGet best practices for secure package management, including repository trust, validation, approval, governance, and enterprise use of Microsoft Artifact Registry and OCI-compliant registries. The article also outlines roadmap investments aimed at secure-by-default package management. ### Source excerpt PowerShell is a critical automation and configuration platform across enterprises--and as that automation grows, how you source, validate, and distribute PowerShell packages becomes just as important as the scripts themselves. Modern security guidance increasingly treats package feeds as part of the software supply chain. For PowerShell, that means being deliberate about which repositories you trust, [...] The post PowerShell PSResource Roadmap and Best Practices appeared first on PowerShell Team. ## Practical Package Security: The Unofficial Guide DevFeed: [Practical Package Security: The Unofficial Guide]() Original publisher: [Read original article]() Author: Rami McCarthy Published: 2026-05-04T14:00:00Z Content type: tutorial Language: en Sources: [Wiz]() Topics: [Package Management](), [Security](), [malicious packages](), [npm](), [renovate](), [Dependabot](), [pnpm](), [PyPI]() Tags: [attack-surface](), [best-practices](), [dependabot](), [dependencies](), [malicious-packages](), [package-management](), [post](), [practical](), [security]() ### AI overview A practical guide to package security that explains how supply-chain compromises spread through maintainer accounts, build systems, and downstream dependencies. It recommends reducing dependency depth, delaying package updates to allow compromise detection, and using tools such as Renovate, Dependabot, pnpm, and uv while balancing security, developer experience, and maintainer sustainability. ### Source excerpt Get actionable best practices to shrink your attack surface, protect execution environments, control package ingestion, and catch compromises early. ## Meet Guix at FOSDEM DevFeed: [Meet Guix at FOSDEM]() Original publisher: [Read original article]() Author: Ludovic Courtès Published: 2026-01-22T13:00:00Z Content type: article Language: en Sources: [GNU Guix]() Topics: [FOSDEM](), [Package Management](), [reproducibility](), [systems]() Tags: [ci-cd](), [community](), [fosdem](), [guix-days](), [package-management](), [reproducibility](), [systems](), [talks]() ### AI overview The Guix community will participate in FOSDEM with talks on package management and reproducibility, bioinformatics workflows, Guile development, build systems, functional reactive programming, container images, and GNU/Hurd. About sixty Guix contributors will then gather for Guix Days on February 2-3. ### Source excerpt It's that time of the year again: next week is FOSDEM time! As in previous years , many Guix people will be in Brussels. Right after FOSDEM, about sixty of us will gather on February 2-3 for the Guix Days! First things first: Guix presence at FOSDEM. On Saturday, January 31st : In Name resolution in package management systems -- A reproducibility perspective , Gábor Boskovits will look will look at how several package managers refer to packages and how this affects reproducibility. Simon Tournier will... ## A Renovate Maintainer's First 100 Days: Lessons from an Open Source Project DevFeed: [A Renovate Maintainer's First 100 Days: Lessons from an Open Source Project]() Original publisher: [Read original article]() Author: Jamie Tanna Published: 2026-01-21T10:54:35Z Content type: article Language: en Sources: [Jamie Tanna]() Topics: [renovate](), [Maintainers](), [Open Source](), [Package Management](), [Command-line interface]() Tags: [bugs](), [cli](), [community](), [contributors](), [dependency](), [documentation](), [maintainers](), [mend](), [open-source](), [package-management](), [renovate](), [users]() ### AI overview A new Renovate maintainer reflects on roughly 100 days working on the open source dependency-update project. The article describes Renovate's contributor structure, community roles, and the experience of operating the project with a lean maintainer team. ### Source excerpt Roughly 100 days ago, I joined Mend to work on the Renovate project as a maintainer and community manager. In a vague homage to the style of politics' "first hundred days", I'll talk about some things that have happened since I've joined the project, and some of the interesting (and mundane) things I've learned since joining the project. This was originally going to be a talk presented at FOSDEM 2026, but there was a lot of strong competition to the half-day Package Management track so I didn't get through to speaking. Instead of losing out on the opportunity to share this, I thought I'd write it up as a blog post instead, as well as it being quite a nice opportunity to reflect back on the last few months. Note that this post is focussing on the Mend Renovate CLI, the Open Source project that is commonly referred to as Renovate, and I won't be going into anything internal to Mend. What's Renovate? First, before we dig into the learnings I've had, let's first explore what Renovate is. It's likely you have some inkling if you're reading this, but it's worth making sure you have the context before reading further. There's a good primer on what Renovate is on a recent post of mine, but a good TL;DR is that Renovate is an Open Source project (AGPL-3.0-only) owned by Mend, which boasts the best support + extensibility in the ecosystem for dependency updates, and we had over 300 human contributors and 1599 releases last year alone. Since starting the project in 2017, we've gone through a few versions of how we operate the project. Right now, we have three classes of folks who interact with the project: Maintainers: the team who have final say on the direction of the project and new features, and whom have merge rights Contributors: people who regularly contribute to Renovate's features, fix bugs, improve documentation and help answer user questions Users: the folks who use Renovate, or are responsible for their Renovate deployment. They may infrequently raise PRs for docum ## Security Without Friction: How RepoFlow Created a DevSecOps Package Manager with Grype DevFeed: [Security Without Friction: How RepoFlow Created a DevSecOps Package Manager with Grype]() Original publisher: [Read original article]() Author: Jono Bergquist Published: 2025-10-30T12:00:00Z Content type: article Language: en Sources: [Anchore]() Topics: [Package Management](), [DevSecOps](), [Security](), [grype](), [supply-chain-security](), [vulnerability scanning](), [Developer Tools]() Tags: [blog](), [build](), [developer-tooling](), [devsecops](), [grype](), [infrastructure](), [package-management](), [security]() ### AI overview RepoFlow developed a package management platform intended to reduce the operational overhead and fragmentation of handling packages across multiple ecosystems. After customers required vulnerability scanning for compliance and adoption, its engineers evaluated integrating security scanning with Grype and Syft while preserving workflow speed, low resource use, and a unified developer experience. ### Source excerpt The post Security Without Friction: How RepoFlow Created a DevSecOps Package Manager with Grype appeared first on Anchore.RepoFlow was created with a clear goal: to provide a simple package management alternative that just works without the need for teams to manage or maintain it. Many existing solutions required constant setup, tuning, and oversight. RepoFlow focused on removing that overhead entirely, letting organizations run a reliable system that stays out of the way. [...] ## Using a Package Manager in GitHub Actions DevFeed: [Using a Package Manager in GitHub Actions]() Original publisher: [Read original article]() Author: Sidrah Abdullah Published: 2025-08-31T19:08:15Z Content type: tutorial Language: en Sources: [Baeldung - Ops]() Topics: [GitHub Actions](), [Continuous integration](), [CI/CD](), [reproducibility]() Tags: [apt](), [best-practices](), [build-times](), [caching](), [code-coverage](), [container-images](), [containers](), [continuous-integration](), [dependencies](), [deployment-tools](), [deployment-tools-git-docker-container-github-actions-package-management-ubuntu](), [docker-container](), [environment](), [git](), [github-actions](), [package](), [package-management](), [ubuntu](), [workflow]() ### AI overview GitHub-hosted Ubuntu jobs start in clean environments, so workflows must install required system packages. The excerpt recommends `apt-get` for scripting and shows `sudo apt-get update` followed by `sudo apt-get install -y lcov`; `sudo` addresses the dpkg permission error, and `-y` avoids an interactive prompt. To reduce repeated installation overhead, group packages in one install command, cache downloaded `.deb` files with `cache-apt-pkgs-action` (using its version as a manual cache key), or use a custom container with dependencies preinstalled. Containers can improve speed and reproducibility, but require maintaining a separate image configuration and rebuilding when it changes. The excerpt also advises installing only needed packages, using noninteractive settings, pinning versions when stability matters, accounting for `ubuntu-latest` image changes, and considering language setup actions such as `actions/setup-python` or `actions/setup-node`, which it says are often faster and more reliable for those runtimes. ### Source excerpt Learn how to safely and wisely use a package manager within GitHub Actions. Related Stories Get Files Modified in a PR in GitHub Actions Use Private Docker Image in GitHub Actions Using GitHub Actions to Create .env File in the Workflow ## Cangjie -- a programming language from Huawei DevFeed: [Cangjie -- a programming language from Huawei]() Original publisher: [Read original article]() Author: Jasper Morgan Published: 2025-08-19T07:37:53Z Content type: opinion Language: en Sources: [Snapp Mobile]() Topics: [Programming language](), [huawei](), [Programming](), [Code](), [Embedded Systems](), [Cross-Compilation](), [Mobile](), [Cloud](), [Package Management](), [debugging](), [Software Testing](), [ide]() Tags: [architectures](), [bytecode](), [cangjie](), [china](), [cloud](), [cross-compilation](), [debugging](), [developers](), [development](), [embedded-systems](), [huawei](), [huawei-developers](), [language](), [mobile](), [package-management](), [programming](), [programming-language](), [programming-languages](), [tools]() ### AI overview This article examines Cangjie, an open-sourced programming language from Huawei. It describes Cangjie as a C-like language with features associated with Swift and Kotlin, support for embedded systems, mobile development, and cloud architectures, interoperability with C and Python, JVM bytecode compilation, cross-compilation, and integrated developer tools. The article suggests Huawei created it to gain more control over its language roadmap and consolidate development skills across products. ### Source excerpt Cangjie -- a programming language from Huawei Huawei have been busy. Last month they open-sourced a programming language that is looking pretty interesting. Whilst you might not be writing in Cangjie next week, it's good to see what one of the world's largest technology companies is doing such that they have created a new programming language. TL;DR Cangjie is a C-like programming language that feels more like Swift/Kotlin than Java/C# or JavaScript/Typescript. The idea is for Cangjie to become the common programming language to be used throughout Huawei. Cangjie can be used for embedded systems, mobile development, server-side cloud architectures. It supports a variety of programming paradigms (function, OO, procedural), compilation and integration options. Cangjie can call C libraries (and be called from C), use Python libraries and even compile to JVM bytecode. Cangjie supports language extension to create lightweight DSLs. Primarily Cangjie programs are compiled into machine code -- this include cross compilation which mean they can run natively on different computer architectures. Cangjie comes with a set of in-built tools for developers such as package management, debugging, testing and IDE integration. Cangjie is openly available since this month and is in version 0.53.13. Why create a new language? Simply put, Cangjie gives Huawei a level of control and an economy of scale that they cannot get from other languages. Most mainstream languages are driven predominantly by teams in USA and Europe. It is hard to influence the road map for these languages -- especially for those tightly controlled by corporations (e.g. Java/Kotlin/Swift). Furthermore, consolidating programming skills could be a big efficiency gain for Huawei -- engineers working on products ranging from routers to petabyte storage to cloud computing and mobile devices can coalesce around one language and toolset. Show me some code I won't go into any detail here so this is just to satisfy your curiosit ## How to Identify the Package Manager of a Linux System DevFeed: [How to Identify the Package Manager of a Linux System]() Original publisher: [Read original article]() Author: Umara Mushtaq Published: 2025-07-14T02:13:11Z Content type: tutorial Language: en Sources: [Baeldung - Linux]() Topics: [Bash](), [Script](), [dnf](), [snap](), [pacman](), [Ubuntu]() Tags: [apt](), [arch-linux](), [article](), [automated](), [automation](), [bash](), [compatibility](), [debian](), [distribution](), [distributions](), [distro](), [dnf](), [fedora](), [how-to](), [introduction](), [linux](), [linux-distribution](), [linux-how-to](), [linux-mint](), [package-management](), [package-management-scripting-apt-dnf-pacman-snap-yum](), [pacman](), [scripting](), [snap]() ### AI overview Identify a Linux system's likely default package manager by checking its distribution in `/etc/os-release` or with `lsb_release`, then verify whether a tool such as `apt` is installed with `which`. The text cautions that a system can have multiple package managers. Its basic Bash script checks with an `if`/`elif` chain and reports only the first match. The more flexible script loops through a fixed list (`apt`, `yum`, `dnf`, `zypper`, `pacman`, `snap`, `flatpak`) to report all detected tools, then maps selected distribution names to a presumed default. The examples map Ubuntu, Debian, and Linux Mint to `apt`; Fedora and Red Hat to `dnf`; CentOS to `yum`; Arch and Manjaro to `pacman`; and openSUSE to `zypper`. ### Source excerpt Learn different ways to guess or identify the default package manager of a Linux system. The post How to Identify the Package Manager of a Linux System first appeared on Baeldung on Linux. Related Stories How to Check for Available Package Updates in Linux How to Properly Install Valgrind? Background Jobs in a Loop in Bash ## Why we love uv DevFeed: [Why we love uv]() Original publisher: [Read original article]() Author: Dennis Hume Published: 2025-04-21T00:00:00Z Content type: article Language: en Sources: [Dagster]() Topics: [Dependency management](), [Python](), [pip](), [Poetry](), [CI/CD]() Tags: [ci-cd](), [engineering](), [package-management](), [python](), [uv]() ### AI overview Python package management has long involved tradeoffs around environment isolation, dependency conflicts, and installation speed. The article describes uv's approach to dependency resolution and parallel installation, then explains how Dagster's dg CLI uses uv to scaffold Python environments for Dagster projects. ### Source excerpt Making Python package management simple and how Dagster leverages uv. ## From XAMPP to Ephemeral Postgres: Where "Works on My Machine" Has Led Us DevFeed: [From XAMPP to Ephemeral Postgres: Where "Works on My Machine" Has Led Us]() Original publisher: [Read original article]() Author: Andrew Tate Published: 2025-02-27T00:51:30Z Content type: article Language: en Sources: [Neon Docs]() Topics: [Web Development](), [XAMPP](), [MySQL](), [PHP](), [configuration](), [Database](), [Package Management](), [toolchain](), [Open Source]() Tags: [apache](), [coding](), [community](), [configuration](), [database](), [databases](), [debugging](), [dependencies](), [developers](), [development](), [environment-variables](), [installations](), [libraries](), [local](), [mysql](), [open-source](), [package-management](), [php](), [servers](), [source](), [systems]() ### AI overview This article looks back at local web development in the 1990s, when developers manually installed and configured Apache, PHP, and databases such as MySQL and Postgres. It describes environment drift, dependency and version conflicts, difficult database setup, manual configuration, and the technical understanding that these constraints encouraged. ### Source excerpt "It works on my machine" is now a trope--a horror story to tell young developers (or AI coding models) about what it was like to build without today's stack. Like all clichés, it was once true. Hodgepodge local installs, no containers, and massive environment drift were challenges... ## Taylor's Morning Routine & Laravel's Open Source Pledge DevFeed: [Taylor's Morning Routine & Laravel's Open Source Pledge]() Original publisher: [Read original article]() Author: Hank Published: 2024-10-08T01:30:00Z Content type: article Language: en Sources: [Laravel Blog]() Topics: [Pull Request](), [Web Development]() Tags: [github](), [laravel](), [open-source](), [package-management](), [php](), [pull-requests](), [vue-js]() ### AI overview Laravel describes its Open Source Pledge, including $34,000 in contributions to foundational projects such as the PHP Foundation, Composer, and Vue.js. The article also outlines a daily pull-request review routine across Laravel's open-source ecosystem. ### Source excerpt I start every morning by opening up a GitHub search that shows me [all the open pull requests](https://github.com/search?q=org%3Alaravel+is%3Apr+is%3Aopen) across Laravel's open source ecosystem. It's... ## How to upgrade Alpine Linux 3.19 to 3.20 DevFeed: [How to upgrade Alpine Linux 3.19 to 3.20]() Original publisher: [Read original article]() Author: Vivek Gite Published: 2024-05-24T11:25:52Z Content type: tutorial Language: en Sources: [nixCraft]() Topics: [Linux](), [upgrade](), [Server](), [Docker]() Tags: [alpine-linux](), [how-to](), [incus](), [intermediate](), [linux](), [package-management](), [server](), [upgrade]() ### AI overview A tutorial explains how to upgrade Alpine Linux installations from version 3.19 to 3.20, including backups, repository changes, package updates, and rebooting. It also covers LXD container snapshots and lists selected Alpine 3.20 software and system changes. ### Source excerpt I am using Alpine Linux v3.18 or v3.19 with my LXD/Incus server. How do I upgrade Alpine Linux v3.19 to Alpine Linux v3.20? How can I upgrade Alpine Linux v3.18 to Alpine Linux v3.20? Love this? sudo share_on: Twitter - Facebook - LinkedIn - Whatsapp - Reddit The post How to upgrade Alpine Linux 3.19 to 3.20 appeared first on nixCraft. ## How to enable Debian 12 Backports repository DevFeed: [How to enable Debian 12 Backports repository]() Original publisher: [Read original article]() Author: Vivek Gite Published: 2024-05-11T11:02:39Z Content type: tutorial Language: en Sources: [nixCraft]() Topics: [Debian](), [Package Management](), [apt](), [Linux]() Tags: [apt](), [apt-cache](), [debian](), [debian-linux](), [dependencies](), [easy](), [how-to](), [install](), [linux](), [package-management](), [packages](), [software-packages]() ### AI overview A tutorial on enabling and using the Debian 12 Bookworm Backports repository. It covers configuring the repository, updating package lists, searching for packages, installing selected backported packages, listing installed backports, and removing them. ### Source excerpt The Debian Linux 12 backports repository offers updated versions of software packages for Debian Stable releases. These packages are sourced from Testing (and sometimes Unstable) branches of Debian, and then optimized and recompiled to function on the current Stable release, such as Bookworm. Let us see how to install and use Debian Linux 12 "Bookworm" Backports repository. Love this? sudo share_on: Twitter - Facebook - LinkedIn - Whatsapp - Reddit The post How to enable Debian 12 Backports repository appeared first on nixCraft. ## Nix Weekly Recap: 2024-05-05 DevFeed: [Nix Weekly Recap: 2024-05-05]() Original publisher: [Read original article]() Published: 2024-05-05T00:00:00Z Content type: article Language: en Sources: [nixpkgs News]() Topics: [Nix](), [Package Management](), [Homebrew](), [Developer Tools](), [Gitea]() Tags: [announcements](), [cncf](), [community](), [governance](), [homebrew](), [package-management](), [recap](), [tooling](), [weekly]() ### AI overview This weekly recap covers governance changes in the Nix ecosystem, including Eelco Dolstra's departure from the NixOS Foundation Board and plans for a constitutional assembly. It also highlights the Aux fork, Brew-nix for packaging Homebrew casks with Nix, Noshell, Buildbot-nix support for Gitea, a Framework partnership, Nix-inst, and a new moderator. ### Source excerpt Weekly recap of the announcements and activity in the Nix community and on the NixPkgs package repository. ## Reimagining the Linux distro with Wolfi DevFeed: [Reimagining the Linux distro with Wolfi]() Original publisher: [Read original article]() Published: 2024-02-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Linux](), [chainguard](), [container-security](), [Security](), [Package Management](), [APK](), [Open Source]() Tags: [apk](), [apko](), [chainguard](), [chainguard-images](), [container-security](), [cve](), [linux](), [melange](), [open-source](), [package-management](), [secure-container-images](), [security](), [vulnerabilities](), [wolfi]() ### AI overview The article explains why Chainguard created Wolfi, a minimal Linux distribution designed for modern container use. It describes the roles of Melange for building APK packages and Apko for assembling reproducible container images, along with Wolfi's security advisory and vulnerability-management capabilities. ### Source excerpt Discover Wolfi: Chainguard's answer to modern container security, creating minimal, secure Linux distributions for today's needs. ## Wolfi: a new paradigm in Linux for containers DevFeed: [Wolfi: a new paradigm in Linux for containers]() Original publisher: [Read original article]() Published: 2024-01-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Linux](), [container](), [Package Management](), [container images](), [Security]() Tags: [apk](), [apko](), [chainguard](), [chainguard-images](), [containers](), [linux](), [melange](), [package-management](), [security](), [wolfi]() ### AI overview Wolfi is a minimal Linux distribution designed for containerized applications. The article describes its focus on efficiency, security, rapid updates, reproducible APK-based package management, and container image creation through melange and apko. ### Source excerpt Wolfi is a Linux distribution built specifically for containerized applications. See how it can speed up your development process. ## Easily customize code scanning using CodeQL model packs for Java (beta) DevFeed: [Easily customize code scanning using CodeQL model packs for Java (beta)]() Original publisher: [Read original article]() Author: Kevin Duck Published: 2023-09-19T16:11:04Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [Visual Studio Code](), [VS Code Extension](), [openjdk](), [Secret Scanning]() Tags: [ai](), [beta](), [code-scanning](), [codeql](), [java](), [model](), [package-management](), [security-vulnerabilities](), [vs-code]() ### AI overview CodeQL model packs for Java (beta) let teams extend code scanning to recognize custom or internally built libraries and frameworks that standard threat models may miss. Packs describe library methods as taint sources, sinks, or propagators (flow summaries), helping CodeQL identify additional potential vulnerabilities. The CodeQL model editor in the VS Code extension can find methods standard analysis does not recognize, let users classify them interactively, and generate a model pack for code scanning. The text says the packs work with both default and advanced setup; it does not detail differences between those setups. ### Source excerpt With CodeQL model packs for Java, users can improve their code scanning results by ensuring that any custom Java libraries and frameworks used by their codebase are recognised by CodeQL.... ## Using Nix with Dockerfiles DevFeed: [Using Nix with Dockerfiles]() Original publisher: [Read original article]() Published: 2023-04-23T00:00:00Z Content type: tutorial Language: en Sources: [Mitchell Hashimoto]() Topics: [Nix](), [Dockerfile](), [Package Management](), [Continuous integration](), [cross-platform]() Tags: [build](), [ci](), [cross-platform](), [development-environment](), [docker](), [docker-compose](), [dockerfiles](), [nix](), [package-management](), [software]() ### AI overview This tutorial explains how pairing Nix with Dockerfiles can provide a consistent software environment across local development, CI, and production. It contrasts this approach with separately maintained environment definitions and introduces a basic example. ### Source excerpt Using Nix with Dockerfiles Nix is a powerful cross-platform package management tool. The benefits of Nix are far reaching, but one big benefit is that once you adopt Nix, you can get a consistent environment across development (on both Linux and Mac), CI, and production. I've been using Nix for many years and recently started building Docker images using a Dockerfile paired with Nix. This post will explain the benefits of this approach along with a basic example to show how it looks and feels. [Next page]()