Arch Linux: Recent news updates

virtualbox-ext-vnc >= 7.2.12-2 requires manual intervention

Christian Hesse — Tue, 21 Jul 2026 13:01:46 +0000

Previously, we installed its contents in a way that made pacman not aware of the files (using VBoxManage extpack install ... from an install script). To mitigate issues during upgrade, you can use one of the following methods:

Uninstall virtualbox-ext-vnc before upgrading the system, then installing it again.
Run VBoxManage extpack uninstall 'VNC' as root before upgrading the system.
Instruct pacman once to overwrite the existing files:

pacman -Syu --overwrite '/usr/lib/virtualbox/ExtensionPacks/VNC/*'

Active AUR malicious packages incident

Campbell Jones — Fri, 12 Jun 2026 18:41:28 +0000

We are currently experiencing a high volume of malicious package adoptions and updates in the Arch User Repository.

We are actively working to track down existing malicious commits and attempting to prevent additional malicious commits from being pushed. While this is happening, and while we work to create a more permanent solution, users may see issues with the following:

Creating new accounts on the AUR
Pushing package updates
Adopting or creating new packages

We continue to encourage all users of AUR packages to review all PKGBUILD and install script changes when updating, especially during this time. If you notice suspicious commits to a package that you use, please reach out to Arch staff via the aur-general mailing list with more information.

Arch Linux 2026 Leader Election Results

Christian Heusel — Thu, 04 Jun 2026 12:27:57 +0000

Recently we held our leader elections and after a lively discussion period on the (internal) mailing lists and voting phase with two candidates Levente "anthraxx" Polyák was re-elected as Arch Linux Project Lead.

As per our election rules he is re-elected with the term lasting two years.

The role of of the project lead within Arch Linux is connected to a bunch of responsibilities regarding decision making (when no consensus can be reached), community leadership, Code of Conduct enforcement, handling financial matters with SPI and overall project management tasks.

Congratulations to Levente, thank you for stepping up to serve this community and all the best wishes for another successful term! 🥳

Breaking changes for all users of `varnish`, which is renamed to `vinyl-cache`

Sven-Hendrik Haase — Mon, 25 May 2026 04:58:52 +0000

The Varnish project has renamed itself to Vinyl Cache. We followed this rename with a new vinyl-cache package. This upgrade results in breaking changes and users are advised to study these changes and how it affects them before following the replacement. All references to "varnish" have been changed to "vinyl" in all binaries and directories.

At minimum, users will have to:

rename /etc/varnish to /etc/vinyl-cache
rename /var/lib/varnish to /var/lib/vinyl-cache
fix up ownership of files inside /var/lib/varnish
user varnish becomes vinyl
group varnish becomes vinyl
user varnishlog becomes vinyllog
user vcache remains the same
disable the old varnish.service and varnishncsa.service systemd units
enable the new vinyl-cache.service and vinylncsa.service systemd units

Meanwhile, the varnish package has been dropped from [extra]. We're not currently planning to maintain a new varnish package as it's a different upstream project.

kea >= 1:3.0.3-6 update requires manual intervention

Robin Candau — Tue, 07 Apr 2026 16:50:29 +0000

The kea package has moved all services to run as a dedicated kea user (instead of root) for improved security. This change requires permission updates to the runtime files created by the kea services.

Users upgrading from an existing kea installation should therefore run the following commands after the upgrade:

chown kea: /var/lib/kea/* /var/log/kea/* /run/lock/kea/logger_lockfile

systemctl try-restart kea-ctrl-agent.service kea-dhcp{4,6,-ddns}.service

Accounts that need to interact with kea services files (e.g. lease files under /var/lib/kea, log files under /var/log/kea or configuration files under /etc/kea) should be added to the kea group.

iptables now defaults to the nft backend

Felix Yan — Sun, 05 Apr 2026 18:28:33 +0000

The old iptables-nft package name is replaced by iptables, and the legacy backend is available as iptables-legacy.

When switching packages (among iptables-nft, iptables, iptables-legacy), check for .pacsave files in /etc/iptables/ and restore your rules if needed:

/etc/iptables/iptables.rules.pacsave
/etc/iptables/ip6tables.rules.pacsave

Most setups should work unchanged, but users relying on uncommon xtables extensions or legacy-only behavior should test carefully and use iptables-legacy if required.

NVIDIA 590 driver drops Pascal and lower support; main packages switch to Open Kernel Modules

Peter Jung — Sat, 20 Dec 2025 18:53:42 +0000

With the update to driver version 590, the NVIDIA driver no longer supports Pascal (GTX 10xx) GPUs or older. We will replace the nvidia package with nvidia-open, nvidia-dkms with nvidia-open-dkms, and nvidia-lts with nvidia-lts-open.

Impact: Updating the NVIDIA packages on systems with Pascal, Maxwell, or older cards will fail to load the driver, which may result in a broken graphical environment.

Intervention required for Pascal/older users: Users with GTX 10xx series and older cards must switch to the legacy proprietary branch to maintain support:

Uninstall the official nvidia, nvidia-lts, or nvidia-dkms packages.
Install nvidia-580xx-dkms from the AUR

Users with Turing (20xx and GTX 1650 series) and newer GPUs will automatically transition to the open kernel modules on upgrade and require no manual intervention.

.NET packages may require manual intervention

George Rawlinson — Thu, 11 Dec 2025 07:01:28 +0000

The following packages may require manual intervention due to the upgrade from 9.0 to 10.0:

aspnet-runtime
aspnet-targeting-pack
dotnet-runtime
dotnet-sdk
dotnet-source-built-artifacts
dotnet-targeting-pack

pacman may display the following error failed to prepare transaction (could not satisfy dependencies) for the affected packages.

If you are affected by this and require the 9.0 packages, the following commands will update e.g. aspnet-runtime to aspnet-runtime-9.0:

pacman -Syu aspnet-runtime-9.0

pacman -Rs aspnet-runtime

waydroid >= 1.5.4-3 update may require manual intervention

George Hu — Thu, 06 Nov 2025 00:35:08 +0000

The waydroid package prior to version 1.5.4-2 (including aur/waydroid) creates Python byte-code files (.pyc) at runtime which were untracked by pacman. This issue has been fixed in 1.5.4-3, where byte-compiling these files is now done during the packaging process.

As a result, the upgrade may conflict with the unowned files created in previous versions. If you encounter errors like the following during the update:

error: failed to commit transaction (conflicting files)

waydroid: /usr/lib/waydroid/tools/__pycache__/__init__.cpython-313.pyc exists in filesystem

waydroid: /usr/lib/waydroid/tools/actions/__pycache__/__init__.cpython-313.pyc exists in filesystem

waydroid: /usr/lib/waydroid/tools/actions/__pycache__/app_manager.cpython-313.pyc exists in filesystem

You can safely overwrite these files by running the following command:

pacman -Syu --overwrite /usr/lib/waydroid/tools/\*__pycache__/\*

dovecot >= 2.4 requires manual intervention

Thore Bödecker — Fri, 31 Oct 2025 21:20:51 +0000

The dovecot 2.4 release branch has made breaking changes which result in it being incompatible with any <= 2.3 configuration file.

Thus, the dovecot service will no longer be able to start until the configuration file was migrated, requiring manual intervention.

For guidance on the 2.3-to-2.4 migration, please refer to the following upstream documentation: Upgrading Dovecot CE from 2.3 to 2.4

Furthermore, the dovecot 2.4 branch no longer supports their replication feature, it was removed.

For users relying on the replication feature or who are unable to perform the 2.4 migration right now, we provide alternative packages available in [extra]:

dovecot23
pigeonhole23
dovecot23-fts-elastic
dovecot23-fts-xapian

The dovecot 2.3 release branch is going to receive critical security fixes from upstream until stated otherwise.