SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 Package Management Open-Source Projects
-
One technique I occasionally have to use is to look at the “zap” stanza of an app’s homebrew cask formula:
https://github.com/Homebrew/homebrew-cask/blob/f44500902e420...
Based on the “notion-updater” I’m guessing there’s also a launchagent/launchdaemon that is “updating” (read: reinstalling) it whenever you manually delete it.
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
What surprised me, going through the tooling landscape for this post, is that nothing else in the stack answers the question either. Renovate understands dependency manifests more deeply than almost any tool in existence, one repository at a time. Asked directly whether cross-repository dependency detection was planned, a maintainer's answer this May was unambiguous: "Renovate only operates on a per-repository basis", with no plans to change. Dependabot has the same shape. The tools that read your manifests every single day read them one repo at a time, and then forget what they saw.
-
Project mention: The CocoaPods Sunset: What Dec 2, 2026 Means for Your React Native App | dev.to | 2026-05-02
Governance: While it is an open-source project hosted on GitHub, it operates through a centralized registry called the CocoaPods Trunk.
-
fpm
Effing package management! Build packages for multiple platforms (deb, rpm, etc) with great ease and sanity.
-
Package managers like Chocolatey (Windows), APT (Linux), and Homebrew simplify software installation and management. They keep your tools up-to-date and reduce dependency conflicts.
-
Absolutely not, there are plenty of use-cases for them. https://www.npmjs.com/package/patch-package comes to mind off the top of my head.
Hopefully current hysteria will not result in some bs decisions like this.
-
> pip allows it but it's with a timestamp
A PR to be able to use a relative timestamp in pip was merged just last week
https://github.com/pypa/pip/pull/13837/commits
-
-
-
Project mention: Postmortem: AI Incident Classifier Failed Due to Biased Training Data and Scikit-Learn 1.5 | dev.to | 2026-05-05
Use dependency pinning tools like Poetry (https://github.com/python-poetry/poetry) or pip-tools (https://github.com/jazzband/pip-tools) to lock all transitive dependencies, not just top-level ones. Before upgrading any ML library, audit the release notes for breaking changes to default parameters: Scikit-Learn maintains a detailed changelog at https://scikit-learn.org/stable/whats\_new.html. For critical pipelines, add a pre-commit hook that checks for unpinned dependencies or unrecognized default parameters. We reduced our dependency-related incidents by 92% after implementing this practice.
-
conda
A system-level, binary package and environment manager running on all major operating systems and platforms.
-
pixi
Powerful system-level package manager for Linux, macOS and Windows written in Rust – building on top of the Conda ecosystem.
Project mention: Thoughts on OpenAI acquiring Astral and uv/ruff/ty | news.ycombinator.com | 2026-03-22+1 for Conda. I also have to mention pixi (https://github.com/prefix-dev/pixi) which kinda is a uv for the Conda ecosystem. Highly recommend!
-
topgrade – All-in-one package updater. Works with choco, scoop, winget, and more.
-
Project mention: Congratulations on creating the one billionth repository on GitHub | news.ycombinator.com | 2025-06-11
A couple weeks ago there was some Lua community issues because LuaRocks surpassed 65,535 packages.
There was a conflict between this and the LuaRocks implementation under LuaJIT [1] [2], inflicting pain on a narrow set of users as their CI/CD pipelines and personal workflows failed.
It was resolved pretty quick, but interesting!
[1] https://github.com/luarocks/luarocks/issues/1797
[2] https://github.com/openresty/docker-openresty/issues/276
-
-
-
I found https://github.com/rubygems/rubygems.org/issues/4294 from 2023. No one had fixed it, yet.
-
The main NuGet was problematic for a long time e.g. not providing any control over transitive dependencies. You had to use https://fsprojects.github.io/Paket/ if you wanted safe and consistent resolution. NuGet since got their act together and it’s not as flawed now.
-
-
safety
Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.
-
-
-
NuGet
NuGet Gallery is a package repository that powers https://www.nuget.org. Use this repo for reporting NuGet.org issues.
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Package Management discussion
Package Management related posts
-
How to give GitHub Copilot cross-repo context today
-
Renovate & Dependabot: The New Malware Delivery System
-
The CocoaPods Sunset: What Dec 2, 2026 Means for Your React Native App
-
Postmortem: HashiCorp Vault 1.16 Secret Rotation Failure Caused 4-Hour Outage for Payment Services
-
Open Source Security at Astral
-
Thoughts on OpenAI acquiring Astral and uv/ruff/ty
-
Feedback wanted: monorepos, getting started and "week 1" problems, complexity
-
A note from our sponsor - SaaSHub
www.saashub.com | 10 Jun 2026
Index
What are some of the best open-source Package Management projects? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | Homebrew-cask | 22,060 |
| 2 | renovate | 21,687 |
| 3 | CocoaPods | 14,825 |
| 4 | fpm | 11,479 |
| 5 | Chocolatey | 11,405 |
| 6 | patch-package | 11,197 |
| 7 | pip | 10,191 |
| 8 | PDM | 8,641 |
| 9 | glide | 8,103 |
| 10 | pip-tools | 8,004 |
| 11 | conda | 7,427 |
| 12 | pixi | 7,273 |
| 13 | topgrade | 4,153 |
| 14 | luarocks | 3,697 |
| 15 | BaGet | 2,780 |
| 16 | habitat | 2,743 |
| 17 | RubyGems | 2,430 |
| 18 | Paket | 2,084 |
| 19 | pypiserver | 2,038 |
| 20 | safety | 1,982 |
| 21 | bpkg | 1,970 |
| 22 | bioconda-recipes | 1,832 |
| 23 | NuGet | 1,630 |
Sponsored
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com