I was browsing the source code and I noticed that the package manager is using sandbox-exec to sandbox the loading of the manifest. However, according to the man page this command is deprecated at least since macOS 10.12 (I don't have access to earlier versions).
Are there any plans in replacing it and what would be the path forward?
Thats a very good question! We are indeed aware of this deprecation but we do not have a concrete plan for a replacement right now. However, it is on our to-do list to ensure that SwiftPM users are unaffected by this deprecation.