Every new package manager has to convince OSV, PURL, Dependabot, Renovate, Snyk, Syft, deps.dev, GitHub, GitLab, JFrog, and Sonatype to care... separately.

Exploring all the steps @zig's package manager will need to take to be fully integrated into the OSS Security Ecosystem: https://nesbitt.io/2026/01/29/zig-and-the-mxn-supply-chain-problem.html