Shelly ALPM v3.0.5 Ships With a Polkit Warning Update and a Sign of Stability
The smallest release in the current v3.x line reflects a project settling into its post-rewrite rhythm.
Shelly ALPM v3.0.5 hit the shelves at 01:32 UTC today, and if you're expecting a feature drop, you're in for a letdown. It's a maintenance bump. Barely. Just two pull requests merged by core maintainer @caroberrie, with an updated Polkit warning as the only user-facing change.
This is the seventh release in the current v3.x line since the massive Zig rewrite shipped on July 29. Six releases in roughly two weeks. Then v3.0.5 drops one day after the feature-packed v3.0.4, and it's practically a whisper. That's not a bug. It's a feature. It tells you the team trusts the core package management code enough to stop chasing new functionality and start polishing the friction points.
The Polkit Warning and the Routine Back-Merge
The Polkit warning covers what users see when Shelly needs sudo-level access to install, remove, or upgrade system packages. The message got updated in PR #1689, likely to clarify exactly which operation the elevation prompt is requesting. Polkit prompts have been a notorious friction point on modern Linux for years. Fixing the wording is the kind of quiet quality-of-life upgrade that actually keeps people from clicking Cancel out of confusion.
PR #1686 is exactly what it sounds like. A routine back-merge of master into the development branch. No user-facing impact. Just internal housekeeping to keep the feature branches synced. The 22 CI checks passed without a hitch.
Keep in mind that this quiet bump lands on top of a foundation most Arch package managers would kill for. The July 29 rewrite eliminated the .NET runtime entirely. Hundreds of C# source files got retired. Shelly now links directly to libalpm, the same C library pacman uses internally. That means no subprocess spawning, no shell scraping, and reportedly ~40% faster search results compared to legacy GUI tools. It's genuinely native performance. The project also ships with three interaction modes now: the GTK4 desktop UI, a structured CLI with JSON output, and a TUI that landed in v3.0.4.
The reception on r/archlinux hasn't been entirely uniform. The earlier release thread showed genuine praise for the unified AUR and Flatpak handling, but the classic Arch skepticism also showed up. One commenter called out the direct libalpm linkage as a red flag, preferring traditional pacman wrappers. Fair enough. Skipping the wrapper middleman trades a layer of proven safety for raw speed. However, at the same time, the direct linkage does require a bit more trust in the maintainers' security practices. The project's GitHub Discussions page remains active, with threads covering cache handling, PWA installers, and headless operation modes.
It's a rather quiet release for a project that's been moving at breakneck speed. But that's actually a good sign. When the only change you need to ship is a warning dialog tweak, your core logic is probably solid. The rapid-fire cadence is cooling off, which means fewer surprise regressions and more time for community PRs to actually land and get tested.
You can grab v3.0.5 from the GitHub releases page. If you're on CachyOS, it's likely already waiting in your package manager. Otherwise, pull it from the AUR via yay or paru, or grab the standalone tarballs if you prefer not to mess with build scripts. Keep in mind that the full UI bundle sits at roughly 6.8 MB, so it won't eat your drive space.
Head here to see the full changelog and download assets.
