RepoJournal
Arch Linux @archlinux
124 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-08-18
stories 56
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

SQLPARSER DOS FIX LANDS IN ARCHWEB

By RepoJournal · Filed · About Arch Linux · Composed from the cited sources · methodology

Caleb Maclennan dependabot Lukas Fleischer Rafael Epplée Sven-Hendrik Haase George Hu
6 people shipped this
Caleb Maclennan @alerque 3 cited dependabot @dependabot 1 cited Lukas Fleischer @lfos 1 cited Rafael Epplée @raffomania 1 cited Sven-Hendrik Haase @svenstaro 1 cited George Hu @Integral-Tech

Arch Linux's dependency stack just got a critical safety fix, and it's not the one you think.

The most urgent item on your board today is sqlparse 0.6.0 in archweb [1], which the changelog says "Fixes a potential denial of service attack (DOS) in the lexer" and drops Python 3.8 and 3.9 support. The other notable moves are routine package promotions: gitlab 19.2.4-1 hits extra [2], task jumps to 3.5.0-1 [6], and matugen 4.2.0 [7] plus glaze 8.1.0 [8] both arrive as fresh updates. On the buildbtw front, the team removed the SSH pubkey option entirely [3] and merged a new struct for loading builds [4], plus they now inject the SSH host key directly into /etc/ssh/known_hosts in the container [5]. That host key change is the only approach that works, per the Containerfile comment. With 55 commits and a single PR across three repos, this is a quiet but consequential day. The sqlparse patch is the one deployment you cannot skip.

Action items

References

  1. [1] build(deps): bump sqlparse from 0.5.5 to 0.6.0 ↗ archlinux/archweb
  2. [2] update gitlab to 19.2.4-1 in extra-x86_64 archlinux/state ↗
  3. [3] Merge branch 'remove-ssh-pubkey-option' into 'main' ↗ archlinux/buildbtw
  4. [4] Merge branch 'add-struct-for-loading-build-with-iteration-and-buildspace' into 'main' ↗ archlinux/buildbtw
  5. [5] Inject SSH host key directly into /etc/ssh/known_hosts in container ↗ archlinux/buildbtw
  6. [6] update task to 3.5.0-1 in extra-x86_64 archlinux/state ↗
  7. [7] update matugen to 4.2.0-1 in extra-x86_64 archlinux/state ↗
  8. [8] update glaze to 8.1.0-1 in extra-any archlinux/state ↗

$ ls archlinux/reviews/ # the step-back reads

the week in review Kernel v7.2.4-arch1 ships with userns sysctl the month in review August's Arch: AUR hardening, kernel churn, and steady package flow
Full archive → Weekly reviews →

Quick answers

What shipped in Arch Linux on August 18, 2026?
Arch Linux's dependency stack just got a critical safety fix, and it's not the one you think. In total, 55 commits and 1 pull requests landed.
Who contributed to Arch Linux on August 18, 2026?
6 developers shipped this update, including dependabot, Caleb Maclennan, George Hu, Lukas Fleischer, Rafael Epplée, and Sven-Hendrik Haase.
What were the notable Arch Linux updates?
build(deps): bump sqlparse from 0.5.5 to 0.6.0, update gitlab to 19.2.4-1 in extra-x86_64, and Merge branch 'remove-ssh-pubkey-option' into 'main'.
♥

$ log @archlinux --recent

Felix Yan promotes the xmonad stack to extra, moor lands at 2.19.2 50 shipped Synapse 1.161.0 lands in infrastructure, anki promoted to extra 70 shipped Arch ships a CLONE_NEWUSER kill switch in v7.2.6-arch2 59 shipped mise and asusctl land in extra, tracexec hits 1.0 50 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.