# Package Registries

Published articles for Package Registries.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## A Difference Without a Distinction: A Measurement Study of Release Trust Evidence in Package Registries

DevFeed: [A Difference Without a Distinction: A Measurement Study of Release Trust Evidence in Package Registries](<https://devfeed.tech/articles/a-difference-without-a-distinction-a-measurement-study-of-release-trust-evidence-in-package-registries-101350.md>)

Original publisher: [Read original article](<https://arxiv.org/abs/2606.22593>)

Author: Igor Santos-Grueiro

Published: 2026-10-27T04:00:00Z

Content type: article

Language: en

Sources: [arXiv: Cryptography and Security](<https://devfeed.tech/sources/arxiv-cryptography-and-security.md>), [arXiv: Software Engineering](<https://devfeed.tech/sources/arxiv-software-engineering.md>)

Topics: [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [pnpm](<https://devfeed.tech/topics/pnpm.md>), [trust](<https://devfeed.tech/topics/trust.md>), [project release](<https://devfeed.tech/topics/project-release.md>), [npm](<https://devfeed.tech/topics/npm.md>), [release engineering](<https://devfeed.tech/topics/release-engineering.md>), [PyPI](<https://devfeed.tech/topics/pypi.md>), [rubygems](<https://devfeed.tech/topics/rubygems.md>)

Tags: [1-6](<https://devfeed.tech/tags/1-6.md>), [2025](<https://devfeed.tech/tags/2025.md>), [account](<https://devfeed.tech/tags/account.md>), [alert](<https://devfeed.tech/tags/alert.md>), [analyze](<https://devfeed.tech/tags/analyze.md>), [arxiv](<https://devfeed.tech/tags/arxiv.md>), [attack](<https://devfeed.tech/tags/attack.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [backports](<https://devfeed.tech/tags/backports.md>), [blocks](<https://devfeed.tech/tags/blocks.md>), [branch](<https://devfeed.tech/tags/branch.md>), [central](<https://devfeed.tech/tags/central.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [cs-cr](<https://devfeed.tech/tags/cs-cr.md>), [cs-se](<https://devfeed.tech/tags/cs-se.md>), [measurement](<https://devfeed.tech/tags/measurement.md>), [package](<https://devfeed.tech/tags/package.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [registries](<https://devfeed.tech/tags/registries.md>), [release](<https://devfeed.tech/tags/release.md>), [study](<https://devfeed.tech/tags/study.md>), [trust](<https://devfeed.tech/tags/trust.md>)

### AI overview

The study finds that pnpm's release evidence policy blocks some legitimate updates while detecting only a limited subset of attacks. Replaying pnpm 10.29.3 across 1,997 npm packages, the authors found blocks for 1.6% of popular-package installs and 7.6% of recently updated installs, mostly due to manual backports; semver 6.3.1 accounted for 14 of 16 popular-package failures. The policy can flag an attack only when an earlier version of that package had stronger evidence. In an npm advisory census, that condition held for 17.5% of attacked packages, and attackers with observed access could have added evidence to pass 15 of 17 flagged releases. Full signing-identity pins triggered alerts for 75.8% of packages with multiple keyless-signed releases, often because certificates encode a Git branch or tag. The tested variants did not distinguish recent backports from attacks; the abstract also reports a comparison of release evidence across npm, PyPI, Maven Central, crates.io, and RubyGems but gives no comparative results.

### Source excerpt

arXiv:2606.22593v3 Announce Type: replace-cross Abstract: A stolen npm token or account lets an attacker publish a malicious version of a popular package. Such uploads skip the project's CI workflow and can lack its provenance, so since November 2025 an opt-in pnpm policy refuses any release with weaker evidence than an earlier one. Maintainers also publish backports by hand; how often the policy blocks them and which attacks it flags is unknown. We test the policy on the latest versions of 1,997 popular and recently updated npm packages, replay its variants and identity pins on reconstructed stolen-credential incidents, and analyze an npm malware advisory census. We also compare publication evidence across five package registries: npm, PyPI, Maven Central, crates.io, and RubyGems. With pnpm 10.29.3, 1.6% of popular and 7.6% of recently updated installs are blocked, mostly by backports, and one security fix backported by hand, semver 6.3.1, causes 14 of the 16 popular failures. The policy can flag an attack only if an earlier release of the same package carried stronger evidence. In the census, 17.5% of attacked packages had earlier evidence; two campaigns supply about half of these. Attackers with the observed access could have passed 15 of the 17 flagged releases by adding evidence. Pins on the full signing identity alert on 75.8% of packages with at least two keyless-signed releases, largely because certificates name the Git branch or tag. No variant tells a recent backport and an attack apart: comparing per line or declaring manual lines at the registry admits both, and an age cutoff exempts only old releases.

## Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain

DevFeed: [Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain](<https://devfeed.tech/articles/sign-here-attributing-a-source-for-a-more-trustworthy-software-supply-chain-94517.md>)

Original publisher: [Read original article](<https://arxiv.org/abs/2610.28794>)

Author: Derek Garcia

Published: 2026-10-22T04:00:00Z

Content type: article

Language: en

Sources: [arXiv: Cryptography and Security](<https://devfeed.tech/sources/arxiv-cryptography-and-security.md>), [arXiv: Software Engineering](<https://devfeed.tech/sources/arxiv-software-engineering.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [malicious packages](<https://devfeed.tech/topics/malicious-packages.md>), [software supply-chain attack](<https://devfeed.tech/topics/software-supply-chain-attack.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [PyPI](<https://devfeed.tech/topics/pypi.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [attack-surface](<https://devfeed.tech/tags/attack-surface.md>), [cs-cr](<https://devfeed.tech/tags/cs-cr.md>), [cs-se](<https://devfeed.tech/tags/cs-se.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-prevention](<https://devfeed.tech/tags/malware-prevention.md>), [npm](<https://devfeed.tech/tags/npm.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [repositories](<https://devfeed.tech/tags/repositories.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-attacks](<https://devfeed.tech/tags/software-supply-chain-attacks.md>), [source](<https://devfeed.tech/tags/source.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [transparency](<https://devfeed.tech/tags/transparency.md>), [trust](<https://devfeed.tech/tags/trust.md>)

### AI overview

The study finds that checking whether packages attribute a buildable source could prevent 87.7% to 99.9% of malware in its npm and PyPI analysis, depending on how rigorously the source is vetted. It tests building packages from source as a way to avoid the package registry attack surface, analyzing 47,066 known malicious packages and a sample of 33,138 registry packages. The approach faces a transparency constraint: only 47.4% of benign packages in the study attributed a source an end user could build from. The supplied abstract says the authors also compare this strategy with security scanners, but does not report that comparison's results.

### Source excerpt

arXiv:2610.28794v1 Announce Type: new Abstract: Software supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive. Recent incidents like the Shai-Hulud worm and the Axios compromise demonstrate that a single malicious package can have wide reaching and devastating impacts overnight. These high profile attacks can be traced back to the same culprit: package registries. Although they are a useful convenience to pull prebuilt packages from, is such a commonly exploited component of the software supply chain worth the risk? In this paper, we investigate whether removing the registry from the developer workflow by building packages directly from source can serve as a malware prevention strategy - effectively removing an entire attack surface. Our hypothesis is that malicious packages avoid attributing a source to minimize visibility, while benign packages seek exposure and therefore link to their repositories. We evaluate this through three research questions: how effective is building from source at avoiding malware, how feasible is it to build from source in the current state of the supply chain, and how the building from source strategy compares to state-of-the-art security scanners. To do so, we (1) construct an aggregate dataset of 47,066 malicious packages from four academic and one industry malicious datasets source across npm and PyPI ecosystems, (2) build a snapshot index of all 3.9 million npm and 764 thousand PyPI packages, and (3) analyze all malicious samples alongside a statistically significant sample of 16,569 packages from each registry, totaling 33,138 packages. We find that simply checking for a source has a success rate between 87.7 and 99.9 percent of preventing malware, depending on the level of source vetting. Consequently, there is a significant lack of transparency within benign packages, with only 47.4 percent attributing a source an end user could build from.

## OpenSSF Newsletter - September 2026

DevFeed: [OpenSSF Newsletter - September 2026](<https://devfeed.tech/articles/openssf-newsletter-september-2026-62445.md>)

Original publisher: [Read original article](<https://openssf.org/newsletter/2026/09/30/openssf-newsletter-september-2026/>)

Author: OpenSSF

Published: 2026-09-30T11:25:38Z

Content type: article

Language: en

Sources: [Open Source Security Foundation](<https://devfeed.tech/sources/open-source-security-foundation.md>)

Topics: [openssf](<https://devfeed.tech/topics/openssf.md>), [cyber resilience act](<https://devfeed.tech/topics/cyber-resilience-act.md>), [open source maintenance](<https://devfeed.tech/topics/open-source-maintenance.md>), [Service-Level Agreements](<https://devfeed.tech/topics/service-level-agreements.md>)

Tags: [ai-and-security](<https://devfeed.tech/tags/ai-and-security.md>), [cncf](<https://devfeed.tech/tags/cncf.md>), [community](<https://devfeed.tech/tags/community.md>), [customers](<https://devfeed.tech/tags/customers.md>), [cyber-resilience-act](<https://devfeed.tech/tags/cyber-resilience-act.md>), [enterprise](<https://devfeed.tech/tags/enterprise.md>), [enterprise-security](<https://devfeed.tech/tags/enterprise-security.md>), [guidance](<https://devfeed.tech/tags/guidance.md>), [java](<https://devfeed.tech/tags/java.md>), [learn](<https://devfeed.tech/tags/learn.md>), [linux](<https://devfeed.tech/tags/linux.md>), [manufacturers](<https://devfeed.tech/tags/manufacturers.md>), [mentorship](<https://devfeed.tech/tags/mentorship.md>), [newsletter](<https://devfeed.tech/tags/newsletter.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [openssf-community](<https://devfeed.tech/tags/openssf-community.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [practical](<https://devfeed.tech/tags/practical.md>), [security](<https://devfeed.tech/tags/security.md>), [september-2026](<https://devfeed.tech/tags/september-2026.md>)

### AI overview

The September 2026 OpenSSF newsletter covers sustainable funding for public package registries, Cyber Resilience Act guidance, community security initiatives, AI and dependency risk discussions, project releases, and an upcoming OpenSSF Community Day in Prague.

### Source excerpt

September brings a commitment to sustainable package registries, practical Cyber Resilience Act (CRA) guidance, new community security work, and three conversations on AI, regulation, and dependency risk. Join us in...

## OpenAI's Codex gets reusable cloud environments that follow developers across devices

DevFeed: [OpenAI's Codex gets reusable cloud environments that follow developers across devices](<https://devfeed.tech/articles/openai-s-codex-gets-reusable-cloud-environments-that-follow-developers-across-devices-62222.md>)

Original publisher: [Read original article](<https://siliconangle.com/2026/09/29/openais-codex-gets-reusable-cloud-environments-that-follow-developers-across-devices/>)

Author: Duncan Riley

Published: 2026-09-29T22:58:20Z

Content type: news

Language: en

Sources: [SiliconANGLE](<https://devfeed.tech/sources/siliconangle.md>)

Topics: [remote-development](<https://devfeed.tech/topics/remote-development.md>), [codex](<https://devfeed.tech/topics/codex.md>), [coding assistant](<https://devfeed.tech/topics/coding-assistant.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>)

Tags: [apps](<https://devfeed.tech/tags/apps.md>), [chatgpt](<https://devfeed.tech/tags/chatgpt.md>), [cloud-environments](<https://devfeed.tech/tags/cloud-environments.md>), [codex](<https://devfeed.tech/tags/codex.md>), [codex-security-cloud](<https://devfeed.tech/tags/codex-security-cloud.md>), [coding-agent](<https://devfeed.tech/tags/coding-agent.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [devday](<https://devfeed.tech/tags/devday.md>), [developers](<https://devfeed.tech/tags/developers.md>), [environment-variables](<https://devfeed.tech/tags/environment-variables.md>), [github](<https://devfeed.tech/tags/github.md>), [github-enterprise-server](<https://devfeed.tech/tags/github-enterprise-server.md>), [gitlab](<https://devfeed.tech/tags/gitlab.md>), [network](<https://devfeed.tech/tags/network.md>), [network-secrets](<https://devfeed.tech/tags/network-secrets.md>), [news](<https://devfeed.tech/tags/news.md>), [openai](<https://devfeed.tech/tags/openai.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [secret](<https://devfeed.tech/tags/secret.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [the-latest](<https://devfeed.tech/tags/the-latest.md>), [virtual-machine](<https://devfeed.tech/tags/virtual-machine.md>)

### AI overview

OpenAI has introduced reusable cloud environments for its Codex coding agent. Developers can connect a GitHub repository, let Codex prepare dependencies and startup checks, then launch tasks in separate virtual machines that remain available across devices. Shared configurations let teams use approved setups, while editing permissions are controlled separately. Environments support standard variables and network secrets, which use an allow-listed proxy to protect real values. Access is rolling out to ChatGPT Plus and Pro subscribers, with Business and Enterprise also mentioned.

### Source excerpt

OpenAI Group PBC today rolled out reusable cloud environments for its Codex coding agent, giving developers a saved project configuration they can work from across devices. Announced at the company's DevDay conference, the release targets the preparation that comes before an agent writes a line of code. A cloud environment does that work once. Each [...] The post OpenAI's Codex gets reusable cloud environments that follow developers across devices appeared first on SiliconANGLE.

## Sustaining Package Registries: Why Enterprise Support Is Essential

DevFeed: [Sustaining Package Registries: Why Enterprise Support Is Essential](<https://devfeed.tech/articles/sustaining-package-registries-why-enterprise-support-is-essential-47855.md>)

Original publisher: [Read original article](<https://sdtimes.com/open-source/sustaining-package-registries-why-enterprise-support-is-essential/>)

Author: David Rubinstein

Published: 2026-09-16T17:47:33Z

Content type: news

Language: en

Sources: [SD Times](<https://devfeed.tech/sources/sd-times.md>)

Topics: [Open Source](<https://devfeed.tech/topics/open-source.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Software](<https://devfeed.tech/topics/software.md>), [AI Development](<https://devfeed.tech/topics/ai-development.md>)

Tags: [announcement](<https://devfeed.tech/tags/announcement.md>), [artificial-intelligence](<https://devfeed.tech/tags/artificial-intelligence.md>), [enterprise](<https://devfeed.tech/tags/enterprise.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [latest-news](<https://devfeed.tech/tags/latest-news.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [maven-central](<https://devfeed.tech/tags/maven-central.md>), [npm](<https://devfeed.tech/tags/npm.md>), [nuget](<https://devfeed.tech/tags/nuget.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [registries](<https://devfeed.tech/tags/registries.md>), [security](<https://devfeed.tech/tags/security.md>), [software](<https://devfeed.tech/tags/software.md>)

### AI overview

OpenSSF and major technology organizations argue that public package registries need sustainable enterprise funding to support availability, observability, compliance, and security as software supply-chain demand and threats grow.

### Source excerpt

In a joint statement backed by the Open Source Security Foundation (OpenSSF), major technology leaders including Arm, Datadog, Dell Technologies, Ericsson, GitHub, Google, IBM, Kusari, Microsoft, Red Hat, Rust Foundation, and Sonatype have recognized that the current funding model for public package registries is no longer sustainable. As rapid artificial intelligence adoption reshapes software development... ... continue reading The post Sustaining Package Registries: Why Enterprise Support Is Essential appeared first on SD Times.

## We're In: Enterprise Commitment to Sustainable Package Registries

DevFeed: [We're In: Enterprise Commitment to Sustainable Package Registries](<https://devfeed.tech/articles/we-re-in-enterprise-commitment-to-sustainable-package-registries-42831.md>)

Original publisher: [Read original article](<https://openssf.org/blog/2026/09/16/were-in-enterprise-commitment-to-sustainable-package-registries/>)

Author: OpenSSF

Published: 2026-09-16T08:17:17Z

Content type: release

Language: en

Sources: [Open Source Security Foundation](<https://devfeed.tech/sources/open-source-security-foundation.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Security](<https://devfeed.tech/topics/security.md>), [reliability-engineering](<https://devfeed.tech/topics/reliability-engineering.md>), [Availability](<https://devfeed.tech/topics/availability.md>), [observability](<https://devfeed.tech/topics/observability.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Software](<https://devfeed.tech/topics/software.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [availability](<https://devfeed.tech/tags/availability.md>), [blog](<https://devfeed.tech/tags/blog.md>), [coding-agents](<https://devfeed.tech/tags/coding-agents.md>), [developers](<https://devfeed.tech/tags/developers.md>), [enterprise](<https://devfeed.tech/tags/enterprise.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [observability](<https://devfeed.tech/tags/observability.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [registries](<https://devfeed.tech/tags/registries.md>), [reliability](<https://devfeed.tech/tags/reliability.md>), [software](<https://devfeed.tech/tags/software.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [sustainable-funding](<https://devfeed.tech/tags/sustainable-funding.md>)

### AI overview

The OpenSSF Governing Board and major technology enterprises announce support for sustainable funding models for public package registries. The commitment addresses the infrastructure, security, reliability, compliance, and developer-experience demands created by growing software and AI-driven development activity.

### Source excerpt

The OpenSSF Governing Board and major tech enterprises are partnering to support sustainable funding models for public package registries. This commitment aims to secure and scale the global software supply chain while ensuring open source stays free and accessible for individual developers.

## License data quality improvements

DevFeed: [License data quality improvements](<https://devfeed.tech/articles/license-data-quality-improvements-71518.md>)

Original publisher: [Read original article](<https://github.blog/changelog/2026-08-13-license-data-quality-improvements>)

Author: Allison

Published: 2026-08-13T19:14:12Z

Content type: release

Language: en

Sources: [GitHub Changelog](<https://devfeed.tech/sources/github-changelog.md>)

Topics: [Data Quality](<https://devfeed.tech/topics/data-quality.md>), [software composition analysis](<https://devfeed.tech/topics/software-composition-analysis.md>), [spdx](<https://devfeed.tech/topics/spdx.md>), [PyPI](<https://devfeed.tech/topics/pypi.md>), [GNU General Public License](<https://devfeed.tech/topics/gpl.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [completeness](<https://devfeed.tech/tags/completeness.md>), [coverage](<https://devfeed.tech/tags/coverage.md>), [covering](<https://devfeed.tech/tags/covering.md>), [data](<https://devfeed.tech/tags/data.md>), [data-quality](<https://devfeed.tech/tags/data-quality.md>), [database](<https://devfeed.tech/tags/database.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [dependency-graph](<https://devfeed.tech/tags/dependency-graph.md>), [ecosystem](<https://devfeed.tech/tags/ecosystem.md>), [entries](<https://devfeed.tech/tags/entries.md>), [example](<https://devfeed.tech/tags/example.md>), [github](<https://devfeed.tech/tags/github.md>), [improvements](<https://devfeed.tech/tags/improvements.md>), [license](<https://devfeed.tech/tags/license.md>), [package](<https://devfeed.tech/tags/package.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [quality](<https://devfeed.tech/tags/quality.md>), [registries](<https://devfeed.tech/tags/registries.md>), [software](<https://devfeed.tech/tags/software.md>)

### AI overview

GitHub now prioritizes license metadata from canonical package registries such as npmjs.org and PyPI for dependency graph components, while retaining ClearlyDefined as a fallback. GitHub says this change reduced packages with missing license data from 45% to 24% among 170 million packages; version-range tracking may raise actual coverage further. Instead of requiring a database entry for every version, the system records ranges with their licenses. For example, the text says Grafana versions through 7.5.17 are recorded as Apache-2.0 and versions 8.0.0 or newer as AGPLv3. The updated data is available across GitHub, including dependency insights, SBOMs, Advanced Security license compliance, and dependency review.

### Source excerpt

GitHub now uses package registries like npmjs.org and PyPI to determine license information for software components in the dependency graph. This improves the accuracy and completeness of the licenses shown...

## Packagist is now protected by Aikido Intel and other updates to the PHP registry

DevFeed: [Packagist is now protected by Aikido Intel and other updates to the PHP registry](<https://devfeed.tech/articles/packagist-is-now-protected-by-aikido-intel-and-other-updates-to-the-php-registry-51613.md>)

Original publisher: [Read original article](<https://www.aikido.dev/blog/composer-protected-aikido-packagist>)

Author: Dania Durnas

Published: 2026-06-26T07:52:00Z

Content type: news

Language: en

Sources: [Aikido Security's Blog](<https://devfeed.tech/sources/aikido-security-s-blog.md>)

Topics: [Composer](<https://devfeed.tech/topics/composer.md>), [Package Management](<https://devfeed.tech/topics/package-management.md>), [software supply-chain attack](<https://devfeed.tech/topics/software-supply-chain-attack.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [PHP](<https://devfeed.tech/topics/php.md>), [ecosystem-security](<https://devfeed.tech/topics/ecosystem-security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [composer](<https://devfeed.tech/tags/composer.md>), [malware](<https://devfeed.tech/tags/malware.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [php](<https://devfeed.tech/tags/php.md>), [registry](<https://devfeed.tech/tags/registry.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>)

### AI overview

Aikido's malware feed now blocks known-malicious package versions in Composer 2.10 and later by default. The article explains how Packagist's dependency policy framework removes flagged versions from dependency resolution, including versions identified after a lockfile was created, while allowing manual overrides.

### Source excerpt

Aikido's malware feed now blocks bad package versions in Composer by default. A look at how Packagist is closing whole classes of supply chain attacks. Category: Product & Company Updates

## Introducing Versioned Documentation

DevFeed: [Introducing Versioned Documentation](<https://devfeed.tech/articles/introducing-versioned-documentation-54808.md>)

Original publisher: [Read original article](<https://blog.gitea.com/introducing-versioned-documentation/>)

Author: techknowlogick

Published: 2023-03-27T12:00:00Z

Content type: release

Language: en

Sources: [Gitea Blog](<https://devfeed.tech/sources/gitea-blog.md>)

Topics: [Documentation](<https://devfeed.tech/topics/documentation.md>), [Gitea](<https://devfeed.tech/topics/gitea.md>), [version](<https://devfeed.tech/topics/version.md>), [Repository](<https://devfeed.tech/topics/repository.md>)

Tags: [documentation](<https://devfeed.tech/tags/documentation.md>), [gitea](<https://devfeed.tech/tags/gitea.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [registries](<https://devfeed.tech/tags/registries.md>), [release](<https://devfeed.tech/tags/release.md>), [version](<https://devfeed.tech/tags/version.md>)

### AI overview

Gitea has introduced versioned documentation so users can access documentation matching the Gitea version they run. The new site is built with Docusaurus and deployed through Gitea Actions, with translation work ongoing.

### Source excerpt

The [documentation site](https://docs.gitea.io) has hosted the nightly documentation for the project for a long time now. This works in the majority of cases when someone is referring to the docs to support their Gitea instance. However, sometimes when a highly anticipated feature is merged into the development branch and the documentation is included, users who may not keep up with the release cycle run into problems when attempting to activate or configure functionality that isn't yet in a stable release. For example, as new package registries have been added, some didn't have hints as to which version they were added in, and we subsequently became swamped with questions why the newly added package registry was not present in their instance.

## Deprecation Notice: GraphQL for Packages

DevFeed: [Deprecation Notice: GraphQL for Packages](<https://devfeed.tech/articles/deprecation-notice-graphql-for-packages-73919.md>)

Original publisher: [Read original article](<https://github.blog/changelog/2022-08-18-deprecation-notice-graphql-for-packages>)

Author: Kevin Duck

Published: 2022-08-18T08:16:34Z

Content type: release

Language: en

Sources: [GitHub Changelog](<https://devfeed.tech/sources/github-changelog.md>)

Topics: [GitHub API](<https://devfeed.tech/topics/github-api.md>), [GraphQL](<https://devfeed.tech/topics/graphql.md>), [GitHub Container Registry](<https://devfeed.tech/topics/github-container-registry.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [npm](<https://devfeed.tech/topics/npm.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [deprecation](<https://devfeed.tech/tags/deprecation.md>), [github](<https://devfeed.tech/tags/github.md>), [github-packages](<https://devfeed.tech/tags/github-packages.md>), [graphql](<https://devfeed.tech/tags/graphql.md>), [npm](<https://devfeed.tech/tags/npm.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [packages](<https://devfeed.tech/tags/packages.md>), [rest](<https://devfeed.tech/tags/rest.md>), [rest-api](<https://devfeed.tech/tags/rest-api.md>)

### AI overview

GitHub Packages is being re-platformed to enable fine-grained permissions, organization-level publishing and increased performance. On the new architecture, the container registry and npm packages no longer expose data through GraphQL; GitHub recommends using the REST API instead. Other package registries are expected to migrate in the coming months, after which their GraphQL APIs will also be deprecated. Users with questions can contact GitHub Support.

### Source excerpt

GitHub Packages is being re-platformed, unlocking great capabilities such as fine-grained permissions, org-level publishing and increased performance. Package registries on the new GitHub Packages architecture, including container registry and npm...

## GitHub Actions: Workflows triggered by Dependabot receive dependabot secrets

DevFeed: [GitHub Actions: Workflows triggered by Dependabot receive dependabot secrets](<https://devfeed.tech/articles/github-actions-workflows-triggered-by-dependabot-receive-dependabot-secrets-74236.md>)

Original publisher: [Read original article](<https://github.blog/changelog/2021-11-30-github-actions-workflows-triggered-by-dependabot-receive-dependabot-secrets>)

Author: Sidi Merzouk

Published: 2021-11-30T19:10:45Z

Content type: release

Language: en

Sources: [GitHub Changelog](<https://devfeed.tech/sources/github-changelog.md>)

Topics: [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Dependabot](<https://devfeed.tech/topics/dependabot.md>), [CI/CD secrets management](<https://devfeed.tech/topics/ci-cd-secrets-management.md>)

Tags: [actions](<https://devfeed.tech/tags/actions.md>), [ci](<https://devfeed.tech/tags/ci.md>), [dependabot](<https://devfeed.tech/tags/dependabot.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [package-registries](<https://devfeed.tech/tags/package-registries.md>), [private](<https://devfeed.tech/tags/private.md>), [registries](<https://devfeed.tech/tags/registries.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [workflows](<https://devfeed.tech/tags/workflows.md>)

### AI overview

GitHub Actions workflows triggered by Dependabot will receive Dependabot secrets, enabling CI to pull from private package registries using the same secrets configured for Dependabot. The source says this improves how Actions and Dependabot work together.

### Source excerpt

GitHub Actions workflows triggered by Dependabot will now be sent the Dependabot secrets. This change will enable you to pull from private package registries in your CI using the same...