RepoJournal
Arch Linux @archlinux
124 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-08-24
stories 60
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

ArchLinux Faces Supply Chain Scare With New Cooldown Guard

By RepoJournal · Filed · About Arch Linux · Composed from the cited sources · methodology

correctmost Jan Steffens Lukas Fleischer Christian Heusel renovate
5 people shipped this
correctmost @correctmost 4 cited Jan Steffens @heftig 2 cited Lukas Fleischer @lfos 2 cited Christian Heusel @christian-heusel 1 cited renovate @renovate

Arch moves to slow automated dependency updates to dodge supply chain attacks, right as a debuginfod disk failure went unfixed until the last minute.

The package repo desk is quiet, with routine updates: ImageMagick 7.1.2.30 [1], simdjson 4.6.8 [2], schemacrawler 17.14.0 [3], and pkgconf 3.0.6 [4] all move forward, while unoconv gets dropped from extra-any [5]. More urgent, archinstall adds a 3-day cooldown on dev dependency updates "to help prevent some supply chain attacks" [6], and fixes its renovate auto-merge config [7]. Meanwhile infrastructure bumps the disk on debuginfod.archlinux.org after it filled up and "nobody fixed the alert in time", halting debug info ingestion [8]. The security hardening in archinstall's workflows continues as well, with permissions trimmed and git credentials no longer persisted [9][10].

Action items

References

  1. [1] update imagemagick to 7.1.2.30-1 in extra-x86_64 archlinux/state ↗
  2. [2] update simdjson to 1:4.6.8-1 in extra-x86_64 archlinux/state ↗
  3. [3] update schemacrawler to 17.14.0-1 in extra-any archlinux/state ↗
  4. [4] update pkgconf to 3.0.6-1 in core-testing-x86_64 archlinux/state ↗
  5. [5] remove unoconv from extra-any archlinux/state ↗
  6. [6] Add a cooldown period of 3 days for dev dependency updates (#4725) ↗ archlinux/archinstall
  7. [7] Fix renovate auto merge config (#4723) ↗ archlinux/archinstall
  8. [8] Bump the disk size of debuginfod.archlinux.org ↗ archlinux/infrastructure
  9. [9] Unset default permissions for testing and linting workflows ↗ archlinux/archinstall
  10. [10] Don't persist git credentials during testing and linting workflows ↗ archlinux/archinstall

$ ls archlinux/reviews/ # the step-back reads

the week in review Kernel v7.2.4-arch1 ships with userns sysctl the month in review August's Arch: AUR hardening, kernel churn, and steady package flow
Full archive → Weekly reviews →

Quick answers

What shipped in Arch Linux on August 24, 2026?
Arch moves to slow automated dependency updates to dodge supply chain attacks, right as a debuginfod disk failure went unfixed until the last minute. In total, 55 commits and 5 pull requests landed.
Who contributed to Arch Linux on August 24, 2026?
5 developers shipped this update, including Jan Steffens, Lukas Fleischer, correctmost, renovate, and Christian Heusel.
What were the notable Arch Linux updates?
update imagemagick to 7.1.2.30-1 in extra-x86_64, update simdjson to 1:4.6.8-1 in extra-x86_64, and update schemacrawler to 17.14.0-1 in extra-any.
♥

$ log @archlinux --recent

Felix Yan promotes the xmonad stack to extra, moor lands at 2.19.2 50 shipped Synapse 1.161.0 lands in infrastructure, anki promoted to extra 70 shipped Arch ships a CLONE_NEWUSER kill switch in v7.2.6-arch2 59 shipped mise and asusctl land in extra, tracexec hits 1.0 50 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.