Shelly ALPM 3.2.0 "The Bug Bash" ships as a bug-fix pass over an ambitious Zig rewrite
The small Seafoam Labs team behind Arch Linux's GUI package manager quietly reimplemented libalpm from scratch. Now it's cleaning up what broke.
There's a reason nobody gets excited about bug-fix releases. They're supposed to be invisible. They're supposed to mean nothing broke. Shelly's v3.2.0 is one of those releases, and it's more important than almost any release this year for the hundreds of thousands of users who never asked for it to matter at all.v3.2.0, codenamed "The Bug Bash," went live today. It carries commit 707e65a, with a single commit still ahead on master. This is a focused cleanup after one of the most aggressive rewrite cycles the project has pulled off. In short: someone made something complicated. It broke a few things. Shelly is now fixing them.
How Shelly became the engine no one planned on
Shelly (officially Shelly-ALPM) is a GUI-first package manager for Arch Linux and its derivatives, built by a small open-source group called Seafoam Labs. It pairs a GTK4 desktop app with a command-line interface, and it links directly against libalpm instead of wrapping pacman. That distinction has mattered from day one, mostly as a defense.
The project launched in C# on .NET. That drew real skepticism, especially from Arch users who frown on running a heavyweight runtime as the thing that installs their operating system. The critique was fair in theory. Shelly's counter was that it touches libalpm directly rather than shelling out to pacman, which is what gives it anything close to native behavior.
Then came the rewrite.
The v3.0.0 release landed on July 30, 2026 as a full Zig reimplementation, tagged "a new era for Shelly." The 3.1 series followed at a pace most projects couldn't sustain for a week. The real landmark was v3.1.7 on October 16, 2026, which introduced RLPM, a from-scratch Zig rewrite of libalpm. The notes called it a "bug fix." It wasn't.
It helped that Shelly became CachyOS's default graphical package manager in its April 2026 release, replacing Octopi. That put it in front of users who receive it out of the box. Once RLPM started misbehaving under real load, this stopped being an academic problem.
Keep in mind that RLPM is not a drop-in replacement. It's a genuinely parallel implementation. Once you flip to it, it does not silently fall back to libalpm. It reads repositories, resolves dependencies, verifies and downloads archives, runs hooks, and updates the local database. It can write the native version 9 database format and handle CachyOS's SQLite-based pacman.db. It still leans on libarchive, SQLite, libcurl, and GPG for pieces of the job, though, so it's not entirely independent.
The honesty here is the standout quality. The notes say plainly that "complete libalpm compatibility remains unfinished." There's a TSV compatibility ledger that tracks exactly what's missing. And there's an explicit warning that RLPM's "record recovery" is not full package rollback. Read that before you rely on it.
What v3.2.0 actually fixes
The release notes frame it around "the things that get between you and your packages." Most of the fixes trace back to regressions introduced after RLPM landed.
The Flatpak breakage was probably the ugliest. After v3.1.10, elevated operations stopped handing work back to the invoking user, which Flatpak's system-helper authentication depends on. The fix routes elevation through setpriv and now writes to the invoking user's cache under that user's credentials, including through sudo, doas, pkexec, or run0. Existing ownership messes can be repaired from a normal session:
shelly utility --fix-permissions
That repairs Shelly's own directories. It leaves your parent cache alone, for what it's worth.
The tray icon got three separate fixes. It now watches the package database and refreshes after operations, it stops reconnecting forever when the D-Bus address is missing, and you can finally pick which terminal launches your updates.
Restart detection actually detects now. Post-upgrade checks were reading some /proc files as empty because those files report a size of zero, meaning the checks couldn't gather the data they needed. Shelly reads them correctly now and stops treating a deleted /etc/ld.so.cache as a stale shared library after ldconfig runs.
AUR builds stopped being a coin flip. Shelly resolves computed architecture directives after evaluation, finishes Git mirror maintenance before cloning sources to avoid a race, and names the rejected metadata field when a build fails. Broken PKGBUILDs are suddenly a lot easier to debug.
Package information is cleaner too. Installed versions now take priority in search results instead of being silently replaced by the repository version, upgrade previews show what a repository package will replace, and RLPM correctly reports install status and dates.
There are a few niceties tucked in as well. Multi-package downgrades now work in a single transaction. The desktop transaction view supports ANSI color. The CLI progress line shows transfer speed. And you can select several recommended apps at once.
Vietnamese translations shipped. Catalan got updated. The notes credit the community directly, saying "This bash was built around those reports."
Where things stand
v3.2.0 isn't a feature release the way v3.0.0 or v3.1.7 were. It's the necessary follow-up to a big architectural bet. The roadmap points toward repository modification, which is still in progress, plus offline updates and layout customization.
Head here to the Shelly-ALPM GitHub repo to dig into the release notes yourself.
