Kernel hardens unprivileged namespaces, mkinitcpio stops clobbering files

The kernel desk carried the week. The 7.3 merge window poured series after series of new code into linux-next , and the tree then shipped v7.2.2-arch1 with a new sysctl that lets administrators disable unprivileged CLONE_NEWUSER entirely . That pairs a fast-moving development line with a concrete hardening control for production machines; the sysctl is the kind of knob that distributions and container runtimes will start wiring into their defaults.

mkinitcpio made a user-facing behavior change that deserves more attention than a routine package push. Its functions no longer overwrite existing files and symlinks [1], which used to be the default. If an initcpio build script previously relied on copying over a preexisting target, that now fails; hooks and custom build functions need an explicit removal step first. This is a breaking change for anyone maintaining bespoke initcpio logic.

The supply-chain thread ran through the project tooling, not the package set. archinstall added a three-day cooldown for dev dependency updates [2] and fixed its Renovate auto-merge config [3], so automated dependabot-style PRs can no longer land immediately and without review. On the CI side, archinstall unset default permissions for testing and linting workflows [4] and stopped persisting git credentials during them [5], reducing the blast radius if a workflow is ever compromised. The maintainers describe the intent as adding a deliberate pause before automated changes merge.

Package updates were steady but unremarkable. ImageMagick moved to 7.1.2.30 [6], simdjson to 4.6.8 [7], and wine-staging to 11.16 [8], alongside a quiet removal of unoconv from extra-any [9]. Node.js jumped to 26.8.1 across extra , and debuginfod.archlinux.org got a disk-size bump in infrastructure [10] to keep up with debug symbol growth. None of these deserve urgency on their own, but the mkinitcpio change and the kernel sysctl do.

Arch also promoted a batch of testing packages to stable over the weekend . If you run the default kernel, the v7.2.2-arch1 update is the one to pull now; the cooldown and CI permission changes only matter if you maintain archinstall forks or mirrors of its CI."