Who contributed to Arch Linux on July 27, 2026?

3 developers shipped this update, including Caleb Maclennan, Antonio Rojas, and Leonidas Spyropoulos.

What were the notable Arch Linux updates?

fix: canonicalize dot/plus-address variants when checking email uniqueness, chore(release): prepare version 6.4.2, and remove riff from extra-x86_64.

@archlinux

The Arch Linux org - the rolling distro and the developers who run it

github ↗

Pick a date

Topics: Infrastructure Full archive →

The Wire · Showcase

AURWEB PLUGS EMAIL VALIDATION LOOPHOLE AS PACKAGE REPO TRIMS CRUFT

By RepoJournal · Filed 06:57 UTC on July 27, 2026 · About Arch Linux

3 people shipped this

Leonidas Spyropoulos @inglor 3 cited

Caleb Maclennan @alerque 1 cited

Antonio Rojas @antonio-rojas 1 cited

The AUR web backend just closed a registration flaw that could let attackers bypass email uniqueness checks using Gmail dot-notation tricks, while the main repository purges two stalled packages.

AUR web 6.4.2 shipped with a critical fix: email canonicalization now normalizes dot and plus-address variants before checking uniqueness [1] [2]. Without it, someone could register user+tag@gmail.com after admin@gmail.com claimed the address, since the system compared exact strings instead of normalized forms. The fix adds a static rule table per provider (dot-stripping, plus-tag folding, alias-domain mapping) inspired by industry patterns but avoiding the DoS risk of live MX lookups [1]. Infrastructure bumped aurweb to 6.4.2 immediately [8], so the fix is live. On the repo side, maintainers removed riff from extra-x86_64 and haskell-brick from staging [3] [4], cutting dead weight. Python packages python-jellyfin-apiclient and python-aioesphomeapi graduated from testing repos to stable [5] [6], and amule bumped to 1:3.0.1-2 [7]. Across all three desks, 53 commits touched the stack.

Action items

→ Verify aurweb 6.4.2 is running in production and monitor AUR registration for abuse archlinux/aurweb [immediate]
→ Review any pending email registrations that might have used dot/plus variants before the fix deployed archlinux/aurweb [plan]
→ Pull the latest infrastructure code with 6.4.2 pinned to your deployments archlinux/infrastructure [plan]

References

[1] fix: canonicalize dot/plus-address variants when checking email uniqueness archlinux/aurweb
[2] chore(release): prepare version 6.4.2 archlinux/aurweb
[3] remove riff from extra-x86_64 archlinux/state
[4] remove haskell-brick from extra-staging-x86_64 archlinux/state
[5] move python-jellyfin-apiclient from extra-testing-any to extra-any archlinux/state
[6] move python-aioesphomeapi from extra-testing-x86_64 to extra-x86_64 archlinux/state
[7] update amule to 1:3.0.1-2 in extra-x86_64 archlinux/state
[8] aurweb: bump to 6.4.2 archlinux/infrastructure

Quick answers

What shipped in Arch Linux on July 27, 2026?: The AUR web backend just closed a registration flaw that could let attackers bypass email uniqueness checks using Gmail dot-notation tricks, while the main repository purges two stalled packages. In total, 53 commits landed.
Who contributed to Arch Linux on July 27, 2026?: 3 developers shipped this update, including Caleb Maclennan, Antonio Rojas, and Leonidas Spyropoulos.
What were the notable Arch Linux updates?: fix: canonicalize dot/plus-address variants when checking email uniqueness, chore(release): prepare version 6.4.2, and remove riff from extra-x86_64.

ARCH LINUX KERNEL 7.1.5 LANDS WITH SECURITY AND STABILITY FIXES

The Arch Linux kernel team shipped v7.1.5-arch1, patching critical GPU deadlocks and unprivileged namespace vulnerabilities in one of the distribution's most closely watched packages.

infra 55 shipped 1-min read

@archlinux 3 days ago

LINUX-LTS CLEARS TESTING, ARCHINSTALL FIXES ARM64 GRUB AND LIMINE

Linux-LTS moved from core-testing to stable across x86_64 after validation [ref:1], while archinstall patches critical EFI installation failures on aarch64 that broke both GRUB and Limine [ref:10].

infra 60 shipped 1-min read

@archlinux 4 days ago

KEYCHAIN 3.0 LANDS IN TESTING, ARCHINSTALL TIGHTENS VALIDATION

Arch's package repos are moving fast: keychain climbs to 3.0.0, Deno reaches 2.9.4, and archinstall ships critical validator fixes across Pydantic models.

infra 62 shipped 1-min read

@archlinux 5 days ago

ARCHINSTALL FIXES LOCALIZATION BUILD THAT BROKE THREE TIMES

Archinstall's translation pipeline finally handles runtime binding descriptions correctly, after manual patches kept getting wiped by automated regeneration.

infra 56 shipped 1-min read

Elsewhere on the wire

AI Agents about 22 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 22 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 22 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 22 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.