What shipped in Arch Linux on August 18, 2026?

Arch Linux's dependency stack just got a critical safety fix, and it's not the one you think. In total, 55 commits and 1 pull requests landed.

Who contributed to Arch Linux on August 18, 2026?

6 developers shipped this update, including dependabot, Caleb Maclennan, George Hu, Lukas Fleischer, Rafael Epplée, and Sven-Hendrik Haase.

What were the notable Arch Linux updates?

build(deps): bump sqlparse from 0.5.5 to 0.6.0, update gitlab to 19.2.4-1 in extra-x86_64, and Merge branch 'remove-ssh-pubkey-option' into 'main'.

@archlinux

The Arch Linux org - the rolling distro and the developers who run it

github ↗

Pick a date

Topics: Infrastructure Full archive →

The Wire · Showcase

SQLPARSER DOS FIX LANDS IN ARCHWEB

By RepoJournal · Filed 06:57 UTC on August 18, 2026 · About Arch Linux

6 people shipped this

Caleb Maclennan @alerque 3 cited

dependabot @dependabot 1 cited

Lukas Fleischer @lfos 1 cited

Rafael Epplée @raffomania 1 cited

Sven-Hendrik Haase @svenstaro 1 cited

George Hu @Integral-Tech

Arch Linux's dependency stack just got a critical safety fix, and it's not the one you think.

The most urgent item on your board today is sqlparse 0.6.0 in archweb [1], which the changelog says "Fixes a potential denial of service attack (DOS) in the lexer" and drops Python 3.8 and 3.9 support. The other notable moves are routine package promotions: gitlab 19.2.4-1 hits extra [2], task jumps to 3.5.0-1 [6], and matugen 4.2.0 [7] plus glaze 8.1.0 [8] both arrive as fresh updates. On the buildbtw front, the team removed the SSH pubkey option entirely [3] and merged a new struct for loading builds [4], plus they now inject the SSH host key directly into /etc/ssh/known_hosts in the container [5]. That host key change is the only approach that works, per the Containerfile comment. With 55 commits and a single PR across three repos, this is a quiet but consequential day. The sqlparse patch is the one deployment you cannot skip.

Action items

→ Rebuild archweb and bump sqlparse to 0.6.0 to close the DOS vulnerability archlinux/archweb [immediate]
→ Update gitlab to 19.2.4-1 in your pacman cache before next deploy archlinux/state [plan]
→ Review buildbtw SSH key handling changes for compatibility with your pipelines archlinux/buildbtw [plan]
→ Monitor task 3.5.0-1 for any integration breakage in your build scripts archlinux/state [monitor]

References

[1] build(deps): bump sqlparse from 0.5.5 to 0.6.0 ↗ archlinux/archweb
[2] update gitlab to 19.2.4-1 in extra-x86_64 archlinux/state
[3] Merge branch 'remove-ssh-pubkey-option' into 'main' archlinux/buildbtw
[4] Merge branch 'add-struct-for-loading-build-with-iteration-and-buildspace' into 'main' archlinux/buildbtw
[5] Inject SSH host key directly into /etc/ssh/known_hosts in container archlinux/buildbtw
[6] update task to 3.5.0-1 in extra-x86_64 archlinux/state
[7] update matugen to 4.2.0-1 in extra-x86_64 archlinux/state
[8] update glaze to 8.1.0-1 in extra-any archlinux/state

Quick answers

What shipped in Arch Linux on August 18, 2026?: Arch Linux's dependency stack just got a critical safety fix, and it's not the one you think. In total, 55 commits and 1 pull requests landed.
Who contributed to Arch Linux on August 18, 2026?: 6 developers shipped this update, including dependabot, Caleb Maclennan, George Hu, Lukas Fleischer, Rafael Epplée, and Sven-Hendrik Haase.
What were the notable Arch Linux updates?: build(deps): bump sqlparse from 0.5.5 to 0.6.0, update gitlab to 19.2.4-1 in extra-x86_64, and Merge branch 'remove-ssh-pubkey-option' into 'main'.

SIGNSTAR PATCHES CRITICAL H2 VULNERABILITY

Wiktor Kwapisiewicz pushed a fix to signstar that updates the `h2` crate to a non-vulnerable version, closing a security hole that could have compromised your signing infrastructure.

infra 58 shipped

@archlinux Aug 17

ARCH LINUX PURGES LEGACY 32-BIT MULTIMEDIA LIBS FROM MULTILIB

Antonio Rojas removed five obsolete 32-bit multimedia libraries from the multilib-x86_64 repository in a single sweep, signaling the end of support for aging FireWire and image processing codecs.

infra 50 shipped

@archlinux Aug 16

ARCH CLEANS HOUSE ON WLROOTS, GNOME UNSTABLE MOVES TO BETAS

Arch is dropping both wlroots0.18 and wlroots0.19 from extra repositories, clearing the way for newer compositor stacks across the distro.

infra 50 shipped

@archlinux Aug 15

POSTGREST MOVES TO STABLE, MKINITCPIO FIXES EARLY BOOT SHUTDOWN

PostgREST 10.1.0 graduated from staging after dependency resolution, while mkinitcpio adds critical systemd shutdown tools to initramfs.

infra 52 shipped

Elsewhere on the wire

AI Agents Aug 19

CLINE DESKTOP GOES NATIVE WITH BACKGROUND ALERTS

Cline's desktop app just became a tool you can leave running while you grab coffee, and LangChain is quietly fixing the token math that makes DeepSeek caching actually count.

ai-agents 97 shipped

@CachyOS Aug 19

CACHYOS PUSHES KERNEL 7.1.8 AND SCHEDULER FIXES ACROSS THE STACK

CachyOS is shipping a new kernel meanwhile patching its scheduler stack, and that combination is exactly what you want before your next deploy.

infra 58 shipped

Elixir & Phoenix Aug 19

LiveView memory leak fix leads overnight Elixir cleanup

A handful of pull requests across Elixir and Phoenix are quietly fixing leaks and edge cases that have been nagging at production apps.

elixir 19 shipped

@dotnet Aug 19

MAUI Overhauls NuGet Publishing as FSharp Preps for VS 18.11

MAUI is replacing its custom NuGet publishing with Microsoft's 1ES.PublishNuget, and FSharp is rolling Microsoft.Build deps forward to VS 18.11, two moves that reshape release engineering across the .NET ecosystem.