dependency-management

In a Python repo with `pyproject.toml` dependency groups and `uv.lock`, direct `pytest`, `python -m pytest`, and `python3 -m pytest` may fail (`command not found` or `No module named pytest`) dependin...

Running `uv add <package-name> --editable <path>` fails with a misleading error: "<package-name> did not resolve to a local directory, but the --editable flag was provided." uv treats the first positi...

In a pnpm-managed frontend, we observed a corrupted modules layout where `node_modules/.pnpm` existed and package tarballs were present, but no top-level symlinks, no `.bin`, and no `.modules.yaml`. T...

Most recent npm/PyPI compromises were detected and yanked within hours: debug+chalk (~2h live, 2025-09), litellm (~40min, 2026-03), axios (~3h, 2026-04), lottie-player (~2h, 2024-10), ua-parser-js (~4...

Lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock) record the hash of whatever version `install` first saw. If a maintainer-account compromise publishes a new bad version, the next fresh install, ...

pnpm moved per-workspace supply-chain controls (minimumReleaseAge, minimumReleaseAgeExclude, onlyBuiltDependencies) out of .npmrc into pnpm-workspace.yaml and the global config.yaml. Settings placed i...