Security updates in package managers: Hex, Composer, pnpm and uv

Developers of popular package managers and build systems have released a series of important security updates designed to protect the software supply chain. The changes affect Hex, Composer, pnpm, uv, sbt, and rebar3, patching critical vulnerabilities and introducing new dependency controls.

• Hex 2.6 expanded dependency auditing and updated CI token management.
• Composer 2.11.0 fixed credential leaks and introduced installation delays for fresh packages.
• pnpm, uv, and rebar3 revised certificate trust following the eMudhra incident.

Security updates in Hex 2.6 and Composer

Released on October 23, Hex 2.6 allows resolving specific security warnings without disabling other policy restrictions. The mix hex.audit --policy command checks locked dependencies, and policy_enforce_lock: true enforces verification when fetching packages. CI environments now exchange organization keys for tokens valid for up to 30 minutes, phasing out old user repository keys by January 21, 2027.

Stable Composer 2.11.0, released on October 29, includes installation delays for fresh package versions to mitigate supply chain risks. Composer has stopped sending credential headers to foreign domains and fixed token leaks in composer.lock files. Additionally, data escaping has been improved when creating execution wrappers to prevent command injection.

Fixes in pnpm, sbt, and certificate trust changes

Version pnpm 11.28.9 fixed a crash when processing registry responses and corrected audit behavior with configured exceptions. Build systems sbt 1.13.1 and 2.0.12 patched an extraction vulnerability that allowed writing files outside the target directory. GitHub Actions introduced shared lock files for securing build component commits.

Following the eMudhra certificate authority incident, embedded environments have been updated. Standalone builds of pnpm 11.28.8 and 10.34.8 updated Node.js, removing trust in compromised certificates. uv 0.13.5 updated managed CPython builds with fixed pip, and Erlang's rebar3 switched to the system root certificate store.

Implications for developers and the ecosystem

These updates highlight the growing importance of software supply chain security. Stricter certificate validation, installation delays for new package versions, and limited CI token lifespans minimize risks for developers. Teams are strongly encouraged to update their tooling and review project configurations.