← All reports

Package Manager Timeline

Package managers have had a significant impact on how we build, distribute, and consume software. This timeline documents the evolution of package management systems across both system-level and language-specific ecosystems, from early archive networks to modern dependency managers.

This is a living document—if you know of events that should be included, please reach out on Mastodon or open a pull request on GitHub.


1992

CreationCTAN established
The Comprehensive TeX Archive Network (CTAN) site structure was put together at the start of 1992, officially announced at EuroTeX conference at Aston University in 1993.

1993

CreationFreeBSD Ports collection
August 26, 1993: Jordan Hubbard committed his package install suite Makefile, with port make macros following on August 21, 1994.

1994

Creationdpkg initial release
January 1994: Ian Murdock created dpkg for Debian as a Shell script, later rewritten in Perl, then in C by Ian Jackson.

1995

CreationRPM Package Manager released
September 20, 1995: Red Hat Linux 2.0 was released with RPM (Red Hat Package Manager), the first distribution to include this packaging system.
CreationCPAN launched
October 1995: Jarkko Hietaniemi and Andreas König created the Comprehensive Perl Archive Network, one of the first language-specific package repositories.

1997

Creationpkgsrc created
October 3, 1997: NetBSD developers Alistair Crooks and Hubert Feyrer created pkgsrc, based on FreeBSD ports.
CreationCRAN established
The Comprehensive R Archive Network (CRAN) was founded in 1997 by Kurt Hornik and Friedrich Leisch to host R's source code, executable files, documentation, and user-created packages.

1998

CreationAPT introduced
Advanced Package Tool version 0.0.1 was released by Scott K. Ellis. First test builds were circulated on IRC.

1999

CreationPEAR founded
Stig S. Bakken founded PEAR (PHP Extension and Application Repository) to promote reusable PHP components.

2002

CreationDarwinPorts project started
Landon Fuller, Kevin Van Vechten, and Jordan Hubbard at Apple started DarwinPorts (later renamed MacPorts in 2006).
CreationPacman released
March 2002: Judd Vinet created pacman alongside Arch Linux's launch.
CreationGentoo Linux 1.0 and Portage released
March 31, 2002: Gentoo Linux 1.0 was released with Portage, a source-based package management system inspired by FreeBSD's ports.
CreationYUM created
June 7, 2002: Seth Vidal and Michael Stenner at Duke University created YUM (Yellowdog Updater Modified) for RPM-based Linux distributions.
CreationMaven created
Jason van Zyl created Maven as a sub-project of Apache Turbine.

2003

MilestoneMaven accepted as Apache top-level project
Maven was accepted as a top level Apache Software Foundation project.
CreationNix package manager created
Eelco Dolstra created Nix as part of his doctoral research at Utrecht University, introducing purely functional package management.
CreationPyPI launched
The Python Package Index came online, originally as a pure index without hosting capabilities.

2004

CreationRubyGems released
March 14, 2004: RubyGems version 0.2.0 was publicly released on Pi Day by Chad Fowler, Jim Weirich, David Alan Black, Paul Brannan, and Richard Kilmer.
Major ReleaseMaven 1.0 released
July 13, 2004: Maven 1.0 was released as the first critical milestone.

2005

CreationCabal specification designed
The Haskell Cabal specification was presented at the Haskell Workshop 2005, defining a common architecture for building applications and libraries.
Major ReleaseMaven 2.0 released
October 2005: Maven 2.0 was released after six months in beta cycles.

2006

Creationzypper introduced
December 7, 2006: zypper was introduced with openSUSE 10.2 as the command-line interface for ZYpp.

2007

CreationLuaRocks released
August 9, 2007: Hisham Muhammad released LuaRocks version 0.1, the package manager for Lua modules.

2008

CreationGradle first release
April 21, 2008: Gradle was released under the Apache License 2.0, building on concepts from Apache Ant and Maven.
Creationpip introduced
October 15, 2008: Ian Bicking introduced pip (originally "pyinstall") as an alternative to easy_install.

2009

CreationHomebrew created
May 21, 2009: Max Howell created Homebrew, addressing package management gaps on macOS.

2009

CreationLeiningen 1.0 released
December 5, 2009: Phil Hagelberg released Leiningen 1.0.0 as a build automation and dependency management tool for Clojure.

2010

Creationnpm first release
January 12, 2010: Isaac Z. Schlueter released the first version of npm for Node.js.
Creationcpanminus released
February 20, 2010: Tatsuhiko Miyagawa released cpanminus (cpanm), a lightweight CPAN client.
CreationAlpine Linux 2.0 and APK released
August 17, 2010: Alpine Linux 2.0 was released with APK (Alpine Package Keeper) as its package manager.
Major ReleaseBundler 1.0 released
August 2010: Bundler 1.0 was released, becoming the de facto dependency manager for Ruby projects.
Major ReleaseMaven 3.0 released
October 8, 2010: Maven 3.0 was released with re-worked core, support for parallel builds, and backwards compatibility with Maven 2.
CreationNuGet introduced
October 6, 2010: NuGet (originally "NuPack") was introduced as a package manager for the .NET ecosystem.

2011

CreationChocolatey released
March 23, 2011: Chocolatey version 0.6.0 was released as a package manager for Windows, inspired by apt and other Linux package managers.
Major Releasenpm 1.0 released
May 1, 2011: npm 1.0 was released, a significant milestone for Node.js package management.
CreationCocoaPods released
September 1, 2011: Eloy Durán released CocoaPods for iOS/macOS development, inspired by RubyGems and Bundler.

2012

CreationComposer released
March 1, 2012: Nils Adermann and Jordi Boggiano released Composer, a dependency manager for PHP inspired by npm and Bundler.
Creationpub released with Dart M1
October 16, 2012: pub package manager was included in the Dart M1 SDK release, one year after Dart's initial announcement.
CreationConda released
October 2012: Anaconda 1.1 included the first release of conda, a cross-platform package and environment manager originally developed for Python data science.
CreationGuix announced
November 2012: GNU announced the first alpha release of GNU Guix, a package manager based on Nix.

2013

CreationOPAM 1.0 released
March 2013: OPAM 1.0 was released as the official package manager for OCaml.
CreationDocker released
March 13, 2013: Solomon Hykes publicly demoed Docker at PyCon in Santa Clara, introducing containerization to mainstream development.
CreationScoop released
May 5, 2013: Scoop was released as a command-line package manager for Windows.

2014

Major ReleaseAPT 1.0 released
April 1, 2014: APT 1.0 was released, celebrating its "sweet sixteen" exactly 16 years after initial conception.

2015

CreationCargo released with Rust 1.0-alpha
January 9, 2015: Rust 1.0-alpha was released including Cargo as the official package manager.
CreationStack released
April 29, 2015: Stack, a cross-platform build tool for Haskell, had its first public commit.
MilestoneDNF becomes default in Fedora 22
May 2015: DNF (Dandified Yum) became the default package manager in Fedora 22, replacing YUM.
Creationxdg-app first release
September 2015: First release of xdg-app, a sandboxed application system for Linux (later renamed to Flatpak in 2016).
CreationHelm introduced
October 19, 2015: First commit to Helm, the Kubernetes package manager, by Matt Butcher at Deis.
CreationSwift Package Manager announced
December 3, 2015: Apple released Swift Package Manager alongside open-sourcing Swift.

2016

Creationpnpm development began
January 27, 2016: Rico Sta. Cruz made the initial commit to pnpm, later developed by Zoltan Kochan.
Creationvcpkg launched
September 2016: Microsoft launched vcpkg as a C/C++ library manager for Windows, Linux, and macOS.
Incidentnpm left-pad incident
March 22, 2016: Developer Azer Koçulu unpublished the left-pad package, breaking thousands of projects including React and Babel. npm changed its unpublish policy as a result.
CreationSnap bundled with Ubuntu 16.04
April 21, 2016: Canonical released Ubuntu 16.04 LTS with Snap pre-installed, introducing sandboxed cross-distribution packages to mainstream use.
Renamexdg-app renamed to Flatpak
May 2016: xdg-app 0.6.0 was released with the new name "Flatpak", officially announced June 21, 2016.
Major ReleaseHomebrew 1.0 released
September 21, 2016: Homebrew reached version 1.0.0 after 7 years of development.
CreationYarn released
October 11, 2016: Facebook, Exponent, Google, and Tilde released Yarn as a fast, reliable npm alternative.

2017

Major Releasepnpm 1.0 released
June 28, 2017: pnpm version 1.0 was released by Zoltan Kochan, introducing a novel symlinked node_modules structure.

2017

CreationPipenv announced
January 2017: Kenneth Reitz announced Pipenv, combining Pipfile, pip, and virtualenv into one toolchain.
CreationTerraform Registry launched
September 2017: HashiCorp launched the Terraform Module Registry at HashiConf 2017.

2018

Major ReleaseConan 1.0 released
January 10, 2018: Conan 1.0.0 was released as a stable C/C++ package manager.
CreationPoetry released
February 28, 2018: Sébastien Eustace released Poetry 0.1.0, a Python dependency management and packaging tool.
Milestonepub adopts PubGrub algorithm
April 2, 2018: Natalie Weizenbaum introduced PubGrub, a next-generation version solving algorithm, to Dart's pub package manager.
Incidenteslint-scope compromised
July 12, 2018: Attacker gained access to an npm maintainer account and published malicious eslint-scope 3.7.2 that harvested npm credentials from ~4,500 accounts.
Major Releasepip 18.0 released
July 22, 2018: pip 18.0 was released, adopting Calendar Versioning (CalVer) with a 3-month release cadence.
CreationGo modules introduced
August 24, 2018: Go 1.11 introduced modules with go.mod files, though not enabled by default until Go 1.14.
Incidentevent-stream backdoor
November 26, 2018: The popular event-stream npm package was compromised with Bitcoin-stealing code via the flatmap-stream dependency, targeting Copay wallets.
Major ReleaseRubyGems 3.0 released
December 19, 2018: RubyGems 3.0.0 was released with performance improvements and new features.

2019

Major ReleasePodman 1.0 released
January 16, 2019: Podman 1.0.0 was released as a daemonless container engine and Docker alternative.
Incidentrest-client RubyGem compromised
August 19, 2019: RubyGems.org account was compromised via credential stuffing, leading to malicious rest-client v1.6.13 being published to steal credentials.
Major ReleaseBundler 2.0 released
January 3, 2019: Bundler 2.0 was released, removing support for end-of-life versions of Ruby and RubyGems.
Major ReleaseHomebrew 2.0 released
February 2, 2019: Homebrew 2.0.0 was released with improved Linux support.
Creationmamba released
March 2019: Wolf Vollprecht released the first alpha of mamba, a fast reimplementation of conda using C++ and libsolv.
CreationGitHub Package Registry launched
May 10, 2019: GitHub introduced Package Registry supporting npm, Maven, RubyGems, NuGet, and Docker.
RenameGitHub Package Registry renamed
November 13, 2019: GitHub Package Registry was renamed to GitHub Packages.

2020

Major ReleaseYarn 2 (Berry) released
January 25, 2020: Yarn 2.0 "Berry" was released with a complete rewrite in TypeScript and Plug'n'Play installation strategy.
Major ReleaseComposer 2.0 released
October 24, 2020: Composer 2.0 was released with significant performance improvements and parallel downloads.
CreationDeno 1.0 released
May 13, 2020: Ryan Dahl released Deno 1.0, a JavaScript/TypeScript runtime with built-in package management.
IncidentSolarWinds supply chain attack
December 2020: Discovery of the SolarWinds Orion platform compromise, where attackers injected malicious code into software updates beginning March 2020, affecting ~18,000 customers.
CreationWindows Package Manager preview
May 19, 2020: Microsoft released Windows Package Manager (winget) in preview at Build developer conference.

2021

Major ReleaseHomebrew 3.0 released
February 5, 2021: Homebrew 3.0.0 was released with official Apple Silicon support and a new bottle format.
IncidentCodecov Bash Uploader compromise
April 15, 2021: Codecov disclosed that attackers modified their Bash Uploader script from January 31 to April 1, exfiltrating environment variables from ~23,000 customers' CI environments.
Incidentua-parser-js hijacked
October 22, 2021: The ua-parser-js npm package (8M weekly downloads) was hijacked via account takeover, with malicious versions published containing cryptocurrency miners and password stealers.
IncidentLog4Shell vulnerability disclosed
December 9, 2021: Critical remote code execution vulnerability CVE-2021-44228 disclosed in Apache Log4j (distributed via Maven Central), affecting millions of Java applications worldwide.
Major ReleaseWindows Package Manager 1.0 released
May 27, 2021: Microsoft released version 1.0 of Windows Package Manager (winget) at Build 2021, the first stable version after a year in preview.
Major ReleaseYarn 3.0 released
July 26, 2021: Yarn 3.0 was released with ESBuild integration and improved performance.

2022

Incidentcolors and faker sabotaged
January 9, 2022: Developer Marak Squires intentionally sabotaged his own widely-used npm packages colors.js (23M weekly downloads) and faker.js (2.4M weekly downloads) in protest over lack of compensation.
Major ReleaseHatch 1.0 released
April 2022: Ofek Lev released Hatch 1.0.0, completing a multi-year rewrite of the Python project manager.
IncidentPyPI ctx package compromised
May 24, 2022: The ctx package on PyPI was hijacked after an expired domain was re-registered, allowing attackers to upload malicious code that exfiltrated environment variables to ~27,000 downloads.
CreationBun beta released
July 12, 2022: Jarred Sumner released Bun beta, an all-in-one JavaScript runtime with built-in package manager.
Major Releasenpm 9.0 released
October 19, 2022: npm 9.0.0 was released to standardize defaults and clean up legacy configurations.

2023

Major ReleaseHomebrew 4.0 released
February 16, 2023: Homebrew 4.0.0 was released with faster tap updates via JSON downloads instead of Git clones.
Major Releasepnpm 8.0 released
March 27, 2023: pnpm 8.0.0 was released with performance improvements and new features.
Major ReleaseChocolatey 2.0 released
May 31, 2023: Chocolatey CLI 2.0.0 was released with NuGet v3 feed support and .NET 4.8.
Creationpixi launched
August 16, 2023: prefix.dev launched pixi, a cross-platform package manager built on the conda ecosystem.
Major ReleaseBun 1.0 released
September 8, 2023: Bun 1.0 was released, the first stable version of the JavaScript runtime with built-in package manager.
Major Releasenpm 10.0 released
October 6, 2023: npm 10.0.0 was released to standardize defaults and clean up legacy configurations.
Major ReleaseYarn 4.0 released
October 23, 2023: Yarn 4.0 was released after 53 release candidates with significantly improved install performance.

2024

Creationuv released
February 15, 2024: Astral released uv, an extremely fast Python package installer and resolver written in Rust.
Major Releasepnpm 9.0 released
April 2024: pnpm 9.0.0 was released with breaking changes to the lockfile format.
Major Releasenpm 11.0 released
December 16, 2024: npm 11.0.0 was released with new features and improvements.

2025

Creationrv released
August 26, 2025: Spinel Cooperative released rv 0.1.0, all-in-one tooling for Ruby version and dependency management, inspired by uv.
Major ReleaseHomebrew 5.0 released
November 12, 2025: Homebrew 5.0.0 was released with download concurrency by default and official Linux ARM64 support.

To suggest additions or corrections, please reach out on Mastodon or open a pull request.

← All reports