Shelly ALPM 2.4.1.3 releases with search fixes and timeout adjustments
Seafoam Labs has pushed v2.4.1.3 of Shelly ALPM today. The release date is July 13, 2026. This patch update brings a modest list of changes to the alternative package manager for Arch Linux. You won't see a feature dump here. Instead, the team is addressing user friction and polishing the current experience.
The updates focus on reliability and localization. A fix by @azdanov resolves search and downgrade issues that were causing real headaches for users. On top of that, the project has completed French translations, thanks to @foXaCe. The icons for switches have also been wired up properly.
What's in the patch
Next, the HTTP client timeout for standard packages has been bumped to a flat 30 seconds. If you've noticed intermittent hangs on flaky connections, that should help. It's a simple number change, but one that matters for package verification speeds.
The patch also includes a merge back handled by @caroberrie. That keeps the main branch clean after the recent flurry of activity. Seafoam Labs has been moving fast lately. That's after 88 releases and 3,240 commits in the repo. The project is clearly past the prototype phase.
The tech stack behind the scenes
Shelly tries to carve out a different path than pacman, yay, or paru. It's built primarily in Zig and C#, with direct bindings to libalpm. You won't find any heavy wrappers here. The goal is native performance through direct interaction.
Zig dominates the codebase. C# fills in the rest. The project is 80.6% Zig and 18.3% C#, with the tiny remainder split between Shell and Vala. It targets .NET 10.0 for the runtime. That's a rather ambitious stack for a utility this size. It means you're getting a modern build process, but also a dependency footprint that traditional tools don't have.
Seafoam Labs describes the project as a "native ground-up experience." It provides both a GTK 4 GUI (shelly-ui) and a CLI (shelly). The CLI supports pacman-style shortcodes and JSON output for scripting. It's not just a pretty face; the terminal interface is fully functional.
Security and features
Security isn't an afterthought here. Shelly ships with PostInstallValidator, which scans PKGBUILD install scriptlets for risky network calls. It checks for tool usage across 30+ ecosystems, from npm and pip to curl and docker. If a scriptlet tries to fetch something suspicious, the tool flags it.
There's also HomographValidator. It detects IDN spoofing attacks, looking for zero-width characters and confusable Unicode skeletons. That's a level of scrutiny most users don't think about until they need it.
The package manager casts a wide net for sources. It handles official Arch repositories, AUR packages, Flatpak, and AppImage. It even supports a direct Flathub install button in the UI. Provider-based virtual dependency resolution is built in, along with a visual dependency viewer called "Starfish" on the install page.
Networking gets a nice touch with "Happy Eyeballs" strategy. The HTTP stack uses IPv4-first preference with a 3-second fallback. That helps on mixed networks where IPv6 might be present but broken.
Installation and availability
Seafoam Labs is a small open-source team with a stated mission: "Open-source software deserves the same care and polish as anything you'd pay for." The project has 848 GitHub stars and a healthy community. You can check the contributor list on GitHub to see who's been helping out.
If you want to try Shelly, you have options. CachyOS provides a packaged version:
sudo pacman -S shelly
AUR helpers like yay and paru also support it:
yay -S shelly
You can build from source if you prefer:
git clone https://github.com/Seafoam-Labs/Shelly-ALPM.git cd Shelly-ALPM makepkg -si
Keep in mind that the project is licensed under GPL-3.0. The team is community-funded via Buy Me a Coffee. It's not a corporate-backed effort, which is worth respecting.
The release is live now. Head here to the GitHub repository if you want to check out the source code yourself.
