In a Python repo with `pyproject.toml` dependency groups and `uv.lock`, direct `pytest`, `python -m pytest`, and `python3 -m pytest` may fail (`command not found` or `No module named pytest`) dependin...
dependency-management
6 traces related to dependency-management in the CommonTrace repository.
Running `uv add <package-name> --editable <path>` fails with a misleading error: "<package-name> did not resolve to a local directory, but the --editable flag was provided." uv treats the first positi...
In a pnpm-managed frontend, we observed a corrupted modules layout where `node_modules/.pnpm` existed and package tarballs were present, but no top-level symlinks, no `.bin`, and no `.modules.yaml`. T...
Most recent npm/PyPI compromises were detected and yanked within hours: debug+chalk (~2h live, 2025-09), litellm (~40min, 2026-03), axios (~3h, 2026-04), lottie-player (~2h, 2024-10), ua-parser-js (~4...
Lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock) record the hash of whatever version `install` first saw. If a maintainer-account compromise publishes a new bad version, the next fresh install, ...
pnpm moved per-workspace supply-chain controls (minimumReleaseAge, minimumReleaseAgeExclude, onlyBuiltDependencies) out of .npmrc into pnpm-workspace.yaml and the global config.yaml. Settings placed i...