Seafoam-Labs Ships Shelly 3.0.2 with Security Hardening and a Zig-Based Tray Service
The Arch Linux package manager alternative gets forced confirmations for suspicious PKGBUILDs and a native system tray daemon.
Seafoam-Labs has released Shelly 3.0.2. The maintenance update for the GTK4-based Arch package manager brings a new security boundary and a native system tray service built in Zig.
The headline change is in PR #1558. Shelly now forces user confirmation for AUR packages flagged with PKGBUILD warnings, even if you've configured --no-confirm or enabled the "No Confirm" UI option. The fix addresses a path where legitimate packages would silently fail. As community member SimoneFelici reported in issue #1554, tools like burpsuite and davinci-resolve use dynamic command construction or local binaries that can't be reviewed as text. Before this update, Shelly would return a PkgbuildReviewDeclined error without asking if you wanted to proceed. Now the package manager demands explicit acknowledgment. AUR security is always a tightrope walk, and Shelly is drawing a line under automated bypasses of the review step.
Technical Shifts and Bug Fixes
The second major addition is the native Zig system tray service, shipped in PR #1551. It's a 21-commit contribution from caroberrie with help from azdanov. The service, Shelly.Notifications.Zig, runs as a background daemon for desktop notifications. It watches ~/.config/shelly/config.json for live reloads and handles inter-process communication. Head to the code if you want to dig into the implementation, but the practical upshot is that CLI-only users no longer have to drag the GTK4 runtime around just to get a tray icon. It also separates the notification logic from the UI, which means better testing isolation and lower memory overhead.
On the bug-fix side, ZoeyErinBauer resolved a parsing headache for packages with periods. Issue #1548 flagged that shelly -Is dotnet-sdk-8.0 would claim the package didn't exist. The parser was splitting on periods when constructing identifiers. The fix ensures versioned packages like dotnet-sdk-8.0, qt5-*, and others resolve correctly. Keep in mind that if you manage .NET or Java SDKs on Arch, this was blocking your workflow.
Another fix addresses the silent failure on the pacman lock file. PR #1557 adds a proper error dialog when /var/lib/pacman/db.lck exists. If an update gets interrupted or a power cut happens, Shelly used to leave you staring at a clipped terminal extension with an obscure TransInitFailed message. Now you get a clear notification that another installer is holding the lock.
Architecture and Availability
Shelly has been carving out a niche as a visual interface for the Arch package manager. It talks directly to libalpm and wraps that in a GTK4 front end. The project has grown to 951 stars and 78 forks on GitHub. You can grab Shelly 3.0.2 from the CachyOS repositories with sudo pacman -S shelly, or install it from the AUR via yay or paru. If you prefer building from source, the repo includes a PKGBUILD-git for makepkg -si.
The build chain requires Zig 0.16.0, Vala, and libalpm. The architecture separates the GTK4 UI from the CLI and tray services, with the latter two written in Zig. That separation helps for users running on Arch-based distributions like CachyOS or Garuda Linux who want to minimize bloat.
Shelly 3.0.2 lands just two days after v3.0.1+1. Two days after v3.0.1+1. That's a rapid turnaround. The release is focused on stability and security rather than a feature dump, which makes sense for the post-3.0.0 stabilization phase. For what it's worth, the move to a native Zig tray service also shows the team is thinking about performance and modularity.
Head to the GitHub repo for the full changelog and PR #1559 for the version bump. Keep an eye on the issue tracker if you're running into edge cases with package parsing.
