Seafoam Labs ships Shelly-ALPM v3.1.10, nudging Arch's package manager in a more native direction
The latest release refines AUR builds and RLPM error reporting while chasing a from-scratch rewrite of the very library pacman runs on.
The new release of Shelly, the open-source Arch Linux package manager, landed today. It's led by Zoey Bauer, Shelly's lead maintainer, and the changelog leans hard on making the AUR build system and the project's own engine stop crashing on you. The bigger story here is a from-scratch rewrite of libalpm, the library pacman itself depends on, and a good chunk of the 3.1 series has been about making that rewrite actually work in production.
Shelly isn't the first tool to try making pacman less of a chore. The difference Seafoam Labs keeps pushing is that Shelly links directly to libalpm, the same C library pacman uses, rather than shelling out to the pacman binary the way helpers like yay and paru do. The pitch is that this gives Shelly faster, more precise control and sidesteps a lot of the wrapper tools' limitations. It ships as both a GTK4 desktop app and a command-line interface, with Flatpak and AppImage management folded into the same command surface.
CachyOS, the performance-flavored Arch-based distro, picked Shelly as its default graphical package manager for its April 2026 release. That's significant if you don't follow the project closely, because it means Shelly now lands on the systems of hundreds of thousands of users who never installed it deliberately. So the internal maturation here matters well beyond the hobbyist forums.
The big bet: RLPM
The centerpiece of the 3.1 series is RLPM, Shelly's own package engine written in Zig. Shelly ships with two backends you can switch between on the fly. There's the stock libalpm, which uses pacman's repositories, locks, and caches exactly as they already are. Then there's RLPM, which reimplements database handling, dependency resolution, and the whole transaction lifecycle with no libalpm dependency at all. You pick with a single setting, and it takes effect on the next command. There's no migration step, so switching engines won't reinstall or tidy anything up.
The engineering choices are a bit unusual. Repository databases get read straight from SQLite in memory instead of extracted to disk. Shelly also detects your CPU's architecture tier and settles on the highest supported microarchitecture, running from x86_64 all the way up to x86_64_v4. Archives get copied into a sealed in-memory file before their signatures verify, which blocks a class of time-of-check-to-time-of-use attacks. Hooks run inside their own network namespace by default, and filesystem operations are confined with openat2 to keep symlink resolution from escaping.
The ambition came with a rough patch, though. The prebuilt v3.1.7 binary had a linking problem that left sqlite3_open_v2 unresolved at runtime, effectively killing RLPM operations. That's the feature everyone was most excited about. v3.1.8 landed three days later as essentially a patch for the broken binary. Keep in mind that context: a lot of this series has been about shoring things up, not showing off.
What v3.1.10 actually does
The release focuses on three things: making AUR builds more reliable, cleaning up how upgrades resolve dependencies, and making RLPM's failures easier to read. Building from the AUR has always been the failure-prone step, so Shelly now discovers and installs build dependencies before the prepare phase runs, including cases where one AUR package needs another to build. It reads the metadata without downloading sources or running the package's lifecycle functions, a deliberate choice to keep your reviewed recipe intact.
There are also fixes for parsing quirks like the ${source[0]%%::*} expression, whitespace collapsing in package descriptions, and the oversized HTTP headers GitHub throws during downloads. The last one is a quiet win if you've ever watched a download die to a security header.
Upgrades gained a combined transaction mode, where shelly install standard --upgrade resolves your system upgrade and explicitly requested repository packages in a single operation. That fixes the dependency failures that occur when a package and its updated libraries need to move together. IgnorePkg handling is cleaner too, so ignored-package entries no longer leak into your main config.
RLPM error reporting got the most attention in the polish bucket. Config, database-lock, download, filesystem, and hook failures now keep their underlying technical error while adding context like the action name and exit status. File conflicts now carry the conflicting paths into the diagnostics, and progress bars clear out once their work finishes so your hook output stays readable.
The command line picked up a new shell-style progress bar that opens and closes a little ASCII shell as progress advances, plus a --names-only flag for package lists and searches. Shell completions for Bash, Fish, and Zsh now query Shelly directly instead of leaning on pacman. The desktop app got accessibility focus stops for keyboard and screen-reader users, and the Packages tab is now built on repository results rather than masquerading foreign packages as ones with unsuitable actions. Devario builds, the pacman-less distro profile, no longer fetch or show Arch Linux news during upgrades.
The base also moves to Zig 0.17.0, so if you're building from source you'll need that version and should populate your dependency cache first before going offline.
Upstream lists a few targets for the future: repository modification, offline updates similar to the pacman-offline script, and layout customization. The wider Seafoam Labs stack, including the Devario distro, the Aqueous Wayland compositor, and the Pearl desktop session, hints at a longer-term vision of a coherent, pacman-less Arch-derived setup.
If you just want Shelly today, the path of least resistance is CachyOS, where it's already the default. On Arch and Arch-based systems you can pull it from the AUR through yay or paru, or build from source with the pieces I mentioned. The base install keeps ALPM, AUR, AppImage, and completion commands available even without the optional Flatpak backend, and on first run the CLI writes its config to ~/.config/shelly/config.json.
Head here to the release notes on the Shelly-ALPM GitHub repository.
