v7.1.0

Note

7.1.0 is available on 🐍 PyPI and 🐙 GitHub.

• Breaking: [mpm] Split the [sbom] extra into [sbom-offline] (CycloneDX and SPDX document rendering) and [sbom-online] (the --network vulnerability lookups). pip install meta-package-manager[sbom] no longer resolves: use [sbom-offline] for the previous behavior, adding [sbom-online] for vulnerability scanning.
• [mpm] Define brand-new package managers from the configuration file: a [mpm.managers.<id>] section declares a manager's platforms, CLI and version detection, and per-operation commands with regex or JSON parsers. Defined managers get --<id> / --no-<id> selectors and join the default set.
• [mpm] Manager definitions load only from a trusted local config file (owned by you, not world-writable, never a remote --config URL), and a command-redirecting override (pre_cmds, cli_names, cli_search_path) read from an untrusted source now warns: see the new {doc}security page.
• [mpm] Ship package managers as bundled configuration definitions: TOML files under meta_package_manager/managers/, built through the same schema as a user's [mpm.managers.<id>] section but loaded at startup like built-ins and exempt from the config-file trust gate.
• [gh-ext] Add GitHub CLI extensions (gh extension) manager with installed, search, install, upgrade, and remove support, cross-platform on Linux, macOS, and Windows; mpm's first bundled configuration-defined manager. Requires gh >=2.0.0.
• [soar] Add Soar (pkgforge) package manager with installed, search, install, upgrade, remove, sync, and cleanup support on Linux; a bundled configuration-defined manager. Requires soar >=0.12.0.
• [conda] Add Conda package manager with installed, outdated, search, install, upgrade, remove, and cleanup support, cross-platform on Linux, macOS, and Windows; requires conda >=4.6.0.
• [mpm] Add a global --network / --no-network flag (default off) that opts into network calls during a run.
• [mpm] mpm --network sbom queries OSV.dev for known vulnerabilities across OSV's indexed ecosystems (pip, npm, cargo, gem, composer): CycloneDX gains a vulnerabilities array, SPDX per-package SECURITY external references, and the end-of-run summary a vulnerability count.
• [mpm] OSV responses are cached on disk; network failures, a missing extra, or an unwritable cache degrade gracefully to an SBOM without vulnerability data.
• [mpm] Privilege escalation is now per-manager: system package managers still run state-changing operations through sudo by default, and a new global --sudo / --no-sudo flag or per-manager [mpm.managers.<id>] sudo config key overrides that either way. Resolves #1295 and #33.
• [mpm] Escalating commands authenticate sudo once up front and run through sudo -n, so a password prompt no longer stalls the concurrent fan-out; off a terminal, managers needing root fail fast with a message pointing at --sudo instead of hanging.
• [yay] Honor --cooldown by overlaying a generated init.lua through a private XDG_CONFIG_HOME, holding back AUR upgrades and installs newer than the release-age floor while preserving the user's own yay config. Requires yay 13.0.0 for its Lua hooks.
• [mpm] The CLI gains a global --export-config FORMAT option that prints the fully-resolved configuration (config file, environment, and defaults merged) as toml, yaml, json, json5, jsonc, hjson, or xml, then exits.
• [mpm] Managers sharing a backend lock (brew/cask, apt/apt-mint/deb-get, the RPM and pacman families) now run serially within their family during state-changing commands; members resolving to an identical command run it once. Fixes spurious cask failures when syncing alongside brew.
• [mpm] A single Ctrl+C now aborts a concurrent command promptly: the first interrupt terminates in-flight package-manager subprocesses, so the thread pool drains and the run exits cleanly instead of hanging until a second Ctrl+C and a threading-shutdown traceback.
• [mpm] --timeout now also bounds the manager version-detection probes, not just the operation that follows, so a wedged binary cannot outlast the limit during startup detection.
• [bar-plugin] Cap each mpm call the plugin makes at 60 seconds via --timeout, so a wedged package manager fails the menubar refresh in about a minute instead of stalling it for several.
• [mpm] Raise the click-extra floor from 8.1.1 to 8.2.0, the first release shipping the concurrency primitives, the --export-config option, and the compatibility-matrix machinery mpm relies on.
• [guix] Meta Package Manager is now available in GNU Guix upstream, installable with guix install meta-package-manager.
• [guix] Rename the reference package to meta-package-manager, fetch its source from the tagged git commit, build it with setuptools.build_meta, drop the now-optional SBOM and more-itertools inputs, and fix the python-packageurl input name so guix install --load-path=packaging/guix resolves.
• [nix] Drop the now-optional SBOM and more-itertools dependencies from the reference package definition.
• [pip] Only target a Python the user can actually install into: mpm's own bundled virtualenv and externally-managed interpreters (PEP 668) are skipped, so distro-managed packages no longer surface as bogus outdated pip upgrades. Supersedes the dependency-tree filter from #1767.
• [pip] Probe the Python interpreter version under the short read-only timeout instead of the long state-changing default.
• [mpm] The --cooldown help now shows [default: (disabled)] instead of the bare [default: ""], so the unset state reads as a word rather than an empty string.
• [dnf] upgrade and upgrade --all now pass --assumeyes, as the other dnf operations already did, so upgrades no longer hang on an interactive confirmation prompt.
• [eopkg] upgrade --all now passes --yes-all, matching the single-package upgrade, so it no longer hangs on an interactive confirmation prompt.
• [fwupd] Fix version-pinned installs: the device ID and release version were joined into a single CLI argument that fwupdmgr could not parse.
• [npm] install no longer passes --no-fund and --no-audit twice.
• [mpm] The installation page now documents which Python and click-extra versions each mpm release accepts, in tables regenerated from the release tags and guarded by a drift test.
• [mpm] Catalog every released standalone binary on a new documentation page, linking each platform build to its download and public VirusTotal analysis, with a detection-rate trend chart.
• [mpm] Add a hermetic test replaying each manager's documented CLI samples through its own parsers and command builders, covering installed, outdated, --version, and the mutation commands; corrected the stale samples flagged across a dozen managers. Toward #1023.

Full changelog: v7.0.1...v7.1.0

---

🛡️ VirusTotal scans

Binary	Detections	Analysis
meta-package-manager-7.1.0-linux-arm64.bin	0 / 63	View scan
meta-package-manager-7.1.0-linux-x64.bin	0 / 63	View scan
meta-package-manager-7.1.0-macos-arm64.bin	2 / 60	View scan
meta-package-manager-7.1.0-macos-x64.bin	0 / 61	View scan
meta-package-manager-7.1.0-windows-arm64.exe	2 / 66	View scan
meta-package-manager-7.1.0-windows-x64.exe	11 / 61	View scan