Meta Package Manager Files

[!NOTE] 7.6.0 is available on 🐍 PyPI and 🐙 GitHub.

• [vim-pack] Add Neovim's built-in vim.pack plugin manager (Neovim 0.12 and above) with installed, install, remove and upgrade support. Plugins are keyed on their source URL, and each operation is a Lua one-liner run by a --clean --headless Neovim.
• [zinit] Add the Zinit Zsh plugin manager with installed, install, remove and upgrade support. Zsh is the CLI mpm executes, and the plugin inventory is read from an interactive shell since Zinit tracks plugins in state the user's .zshrc populates.
• [mpm] Show each manager's brand mark on its documentation page and in the manager index, from a new logo attribute naming an SVG vendored under docs/assets/managers/. 54 of the 75 managers carry one; the rest keep the default package glyph. Marks are inlined so they follow the light and dark themes.
• [mpm] Close each manager's documentation page on a changelog of its own: every changelog entry scoped to that manager, grouped by the release that shipped it, newest first.
• [mpm] Add to each manager's infobox an Issues and PRs badge carrying its GitHub label, in the label's own color, linking to every issue and pull request filed under it. Managers sharing an ecosystem share one label, hence one search.
• [mpm] Move how mpm invokes each tool into its infobox: CLI names, extra search paths, the arguments and environment forced on every call, and the call timeout. The How mpm drives section they came from is reduced to the version probe and moved next to the reference traces. The tracker badge and the source file close the box.
• [mpm] Turn every URL of the manager descriptions into a proper link: bare URLs were rendering as dead text on the manager pages and in the API documentation.
• [mpm] Reconcile the changelog's scope tags against the git history of every manager implementation, followed through the 2016 split of the single-file plugin, the move into a dedicated folder and the later conversions to bundled definitions. 13 entries covering mpm's own packaging, installation documentation or CI were rescoped to [mpm], where that work already sits; 6 manager fixes that had never been logged were added; the apt --yes and search fixes were extended to apt-mint, which inherits both; and the 2.3.0 empty-output fix was split into its general and gem-specific halves.
• [mpm] Follow the documentation's own light and dark toggle with the sidebar logo, instead of a single light-only variant that left the wordmark unreadable on the dark theme. Hide the readme banner on the front page, where it duplicated that logo and could not agree with the theme.
• [mpm] Turn the license page into the project's legal sink: it now also carries the trademark notice, the credits for every vendored brand mark, the documentation artwork attributions and a pointer to where dependency licenses live.
• [gnome-shell] Add a GNOME Shell extension (GNOME 46 to 50) mirroring the Xbar/SwiftBar plugin: a top bar indicator lists outdated packages per manager, and every menu action runs mpm itself. Addresses #809.
• [gnome-shell] Attach the packed extension to every GitHub release as an attested mpm-gnome-shell-extension.zip asset, built with gnome-extensions pack.
• [bar-plugin] Menu actions run mpm itself instead of the manager's native upgrade command, so manager selection, sudo policy, overrides and the cooldown all apply. A manager that cannot enforce an active cooldown is now skipped with a warning.
• [mpm] A batch of managers running concurrently reports through a determinate progress bar (Searching [####----] 3/6 managers) instead of an indeterminate spinner. Each manager's own CLI call keeps its per-call spinner when it runs alone.
• [mpm] The ✓/✗ trail's finisher carries an elapsed time only under --time, where it previously always showed one.
• [mpm] The warnings proposing a CLI flag as their remedy now also name the configuration key that makes it stick: [mpm] require_cooldown_support for the cooldown skip, and [mpm] sudo for the two credential warnings.
• [mpm] Raise the click-extra floor from 8.7.0 to 8.8.1, dropping mpm's own is_stdout and prep_path helpers for the click_extra.output originals and inheriting click-extra's own uncapped uv-build requirement.
• [mpm] Rename the 🔌 bar-plugin GitHub label to 🔌 plugin, now covering the Xbar/SwiftBar plugin and the GNOME Shell extension alike.
• [mpm] Fix the 🔌 plugin, 🖥 platform: macOS and 🖥 platform: Windows labels never being applied to issues: their keywords are now OR-joined into one case-insensitive pattern instead of all being required at once.
• [mpm] Fix backup, dump and sbom dying on an unhandled FileNotFoundError when the output path points into a directory that does not exist yet: missing parent directories are now created.
• [mpm] Fix guix install --load-path=packaging/guix failing on unbound python-pytest and python-xmltodict, whose modules were not imported, and align the definition with the upstream Guix stanza.
• [mpm] Fix nix-env --file packaging/nix failing its runtime-dependency check on the stale click-extra 8.6.2 and extra-platforms 13.5.1 pins, bumping them to 8.8.1 and 13.6.0 to satisfy mpm 7.5.0's raised floors.
• [mpm] Add an Unsupported managers page documenting which tools are deliberately excluded and why, and what a manager must expose to be wrappable.
• [mpm] Document that --cooldown replaces a stricter release-age policy already configured natively, instead of tightening it.
• [mpm] Document the retraction path behind each package registry (yank, unpublish, relabel, index revert, flag only) and the per-version publish-date metadata it exposes, since a cooldown only protects where a compromised release can actually be withdrawn. Without one the gate can even prefer a malicious version over the fix that superseded it. Every pool manager is mapped to its registry, and its cooldown documentation page now closes on that registry's row.
• [gnome-shell] Lint the extension and its gjs test runner with ESLint against GNOME Shell's own eslint-config-gnome ruleset, in a new eslint job installing the stack behind a 7-day npm --min-release-age cooldown.
• [mpm] Drop the Codecov integration, its coverage badge and the XML report artifacts that fed it. Coverage is now gated in CI by the [tool.coverage] report.fail_under ratchet, cleared by the parallel non-destructive run; the bar-plugin and destructive slices opt out with --cov-fail-under=0.
• [mpm] Run the project-metadata and GNOME Shell extension invariant tests on a single runner instead of on every matrix cell, behind a new once pytest marker and a once-tests job. Neither module imports package code, so the coverage floor is unaffected.
• [mpm] Widen the test workflow's trigger to changelog.md, readme.md, docs/** and gnome-shell/**. The suite holds all four to byte-identity with their generators, but an edit to any of them never ran the test guarding it.
• [mpm] Declare the supply-chain cooldown window on the GNOME Shell extension and manager-logo workflows, and an explicit zero-length window on the distributor workflow, whose subject is the freshly published artifact.
• [mpm] Drop the full Homebrew cask tap clone and the HOMEBREW_NO_INSTALL_FROM_API override from the test matrix, both left behind by a cask-version-checkout test that no longer exists.
• [mpm] Fix the test matrix's drift guard silently skipping for a week after every upstream toolkit bump: it resolved repomatic without the per-package cooldown exemption, so the workflow's release-age window left the pinned version unresolvable and the failed run landed in the test's skip branch.
• [mpm] Scope the docs dependency group to Python 3.14 and above, the only interpreter that ever renders a page. Its members drop their marker-split floors for flat ones, and the lockfile stops carrying a second, older resolution of the documentation toolchain (myst-parser, sphinx, docutils, markdown-it-py, sphinx-autodoc-typehints, sphinx-design) for interpreters that never build the site.

Full changelog: v7.5.0...v7.6.0