Who contributed to Arch Linux on August 19, 2026?

6 developers shipped this update, including Maxime Gauduin, Caleb Maclennan, George Hu, Sven-Hendrik Haase, Jan Alexander Steffens (heftig), and Wiktor Kwapisiewicz.

What were the notable Arch Linux updates?

fix(deps): Update `h2` to non-vulnerable version, chore(deps): Suppress `h2` 0.3 warning, and buildbtw: Add SSH keys to service accounts.

@archlinux

The Arch Linux org - the rolling distro and the developers who run it

github ↗

Pick a date

Topics: Infrastructure Full archive →

The Wire · Showcase

SIGNSTAR PATCHES CRITICAL H2 VULNERABILITY

By RepoJournal · Filed 06:57 UTC on August 19, 2026 · About Arch Linux

6 people shipped this

Wiktor Kwapisiewicz @wiktor-k 4 cited

Caleb Maclennan @alerque 2 cited

Sven-Hendrik Haase @svenstaro 2 cited

Maxime Gauduin @alucryd 1 cited

George Hu @Integral-Tech 1 cited

Jan Alexander Steffens (heftig) @heftig 1 cited

Wiktor Kwapisiewicz pushed a fix to signstar that updates the `h2` crate to a non-vulnerable version, closing a security hole that could have compromised your signing infrastructure.

The signstar team dropped everything to patch a critical dependency: the `h2` update [1] addresses a vulnerability in the hyperium advisory GHSA-q83h-524g-xf6h, and while the same crate's 0.3 warning is suppressed for tests only [2], this is the kind of fix you verify before your next signing run. Meanwhile, the archlinux infrastructure desk merged SSH keys for buildbtw service accounts [3] and followed up by copying private keys into the container [4], a move that tightens access control but warrants a quick audit of who holds those keys. Synapse jumped to 1.159.0 [5], a routine upgrade but one that keeps your Matrix federation healthy. On the package front, mise moved from extra-testing to extra [6], and luajit got a bump [7] alongside praat and zeroclaw updates [8][9], all standard but worth a glance if you depend on them. The docs for `CryptographicKeyContext::openpgp_cert_size` also got a polish [10], and the new return type for certificate size estimation [11] signals a cleaner API. Across 58 commits in three repos, this is the security patch that stands out.

Action items

→ Rebuild signstar with the patched h2 to eliminate the vulnerability archlinux/signstar [immediate]
→ Audit SSH keys added to buildbtw service accounts archlinux/infrastructure [plan]
→ Update Synapse to 1.159.0 on your Matrix servers archlinux/infrastructure [monitor]
→ Review the new certificate size estimation API in signstar archlinux/signstar [monitor]

References

[1] fix(deps): Update `h2` to non-vulnerable version archlinux/signstar
[2] chore(deps): Suppress `h2` 0.3 warning archlinux/signstar
[3] buildbtw: Add SSH keys to service accounts archlinux/infrastructure
[4] buildbtw: Copy SSH private keys and mount them into container archlinux/infrastructure
[5] matrix: Update synapse to 1.159.0 archlinux/infrastructure
[6] move mise from extra-testing-x86_64 to extra-x86_64 archlinux/state
[7] update luajit to 2.1.1787058514+27f169c-1 in extra-x86_64 archlinux/state
[8] update praat to 7.0.01-1 in extra-x86_64 archlinux/state
[9] update zeroclaw to 0.8.4-1 in extra-x86_64 archlinux/state
[10] docs: Improve `CryptographicKeyContext::openpgp_cert_size` documentation archlinux/signstar
[11] feat: Return `Result<Option<usize>, Error>` for certificate size estimation archlinux/signstar

Quick answers

What shipped in Arch Linux on August 19, 2026?: Wiktor Kwapisiewicz pushed a fix to signstar that updates the `h2` crate to a non-vulnerable version, closing a security hole that could have compromised your signing infrastructure. In total, 58 commits landed.
Who contributed to Arch Linux on August 19, 2026?: 6 developers shipped this update, including Maxime Gauduin, Caleb Maclennan, George Hu, Sven-Hendrik Haase, Jan Alexander Steffens (heftig), and Wiktor Kwapisiewicz.
What were the notable Arch Linux updates?: fix(deps): Update `h2` to non-vulnerable version, chore(deps): Suppress `h2` 0.3 warning, and buildbtw: Add SSH keys to service accounts.

LINUS PULLS INTEGRITY FIX FOR TPM-BYPASS

Linus merged the integrity-v7.3 tag, addressing a TPM initialization race that could silently bypass IMA.

infra 100 shipped

@archlinux Aug 18

SQLPARSER DOS FIX LANDS IN ARCHWEB

Arch Linux's dependency stack just got a critical safety fix, and it's not the one you think.

infra 56 shipped

@archlinux Aug 17

ARCH LINUX PURGES LEGACY 32-BIT MULTIMEDIA LIBS FROM MULTILIB

Antonio Rojas removed five obsolete 32-bit multimedia libraries from the multilib-x86_64 repository in a single sweep, signaling the end of support for aging FireWire and image processing codecs.

infra 50 shipped

@archlinux Aug 16

ARCH CLEANS HOUSE ON WLROOTS, GNOME UNSTABLE MOVES TO BETAS

Arch is dropping both wlroots0.18 and wlroots0.19 from extra repositories, clearing the way for newer compositor stacks across the distro.

infra 50 shipped

Elsewhere on the wire

AI Agents Aug 20

LangChain ships core 1.6.0 with a security warning tucked inside

LangChain's newest core release fixes a tool-injection bug, but the fix itself widens the path for arbitrary code execution.

ai-agents 95 shipped

Local LLMs Aug 20

OLLAMA FIXES DEADLOCK THAT HUNG CHAT AND GENERATE

A mid-stream parser error in Ollama's server silently wedged chat and generate requests, leaking goroutines and hanging retries until a fix landed overnight.

+14

llms 268 shipped

@CachyOS Aug 20

LINUX-CACHYOS SHIPS 7.2.0-1

CachyOS's custom kernel just advanced to 7.2.0-1, and the sched-ext toolchain is moving in lockstep.

infra 55 shipped

Elixir & Phoenix Aug 20

LIVE VIEW HOOKS GET THE ELOQUENT TREATMENT

Phoenix Live View is shipping a passel of hook and JS-client fixes today, headlined by new beforeUpdate arguments that hand you more control over a hook's lifespan.