pip
3 mentions across all digests
Traditional Python package manager that remains more widely deployed than uv in established GitHub repositories
What's new in pip 26.1 - lockfiles and dependency cooldowns!
Pip 26.1 introduces reproducible lockfiles and security-focused dependency cooldowns (`--uploaded-prior-to`) to enforce minimum package age in Python builds.
Npm Slop & Wonky Software Supply Chains
npm and pip registries lack provenance verification for uploaded bundles, creating exploitable supply chain vulnerabilities that source-reproducible builds cannot practically mitigate.
Why Aren't We uv Yet?
While Python developers favor uv by 74.2% in sentiment surveys, actual adoption reaches only 43-44% of pip's levels—a stark gap between preference and practice in package management.