github Seafoam-Labs/Shelly-ALPM v2.4.1.0
on GitHub

5 hours ago

Shelly-ALPM v2.4.1.0 Release Notes

This release builds directly on the 2.4.0 line, hardening how Shelly talks to the
network and to the system, deepening dependency resolution, and continuing the CLI
refactor that began in 2.4.0.0. It also bundles a large batch of community
translations and a steady stream of UI polish across the AppImage, Flatpak, and grid
views.

🌐 Networking — Happy Eyeballs

Shelly's HTTP stack now uses a Happy Eyeballs-style connection strategy in
OptimizedClient. Instead of waiting on a single resolved address, Shelly resolves
every address for a host, prefers IPv4 first so a missing IPv6 route can never block a
working connection, and races the candidates with a fast 3-second per-address
fallback. Critically, it waits for the first connection to succeed rather than the
first to complete, so a quick "network is unreachable" failure on one path no longer
aborts a request that a slower path would have served. Address-connection fallback in
OptimizedClient was further tuned for reliability on mixed IPv4/IPv6 hosts.

🔒 Security — More risky tools, smarter privileges

The PostInstallValidator scriptlet scanner was expanded well beyond the original
list. It now recognizes risky network- and code-fetching tooling across a wide range
of ecosystems — JavaScript/Node (npm, npx, yarn, pnpm, bun, deno), Python
(pip, pipx, uv, poetry, conda/mamba), Ruby, Rust, Go, PHP, Perl, Haskell,
Lua, Nim, OCaml, Elixir/Erlang, C/C++ (conan, vcpkg), JVM build tools, .NET,
Swift, Julia, R — alongside downloaders (curl, wget, aria2c, lftp, rsync,
scp/sftp), container/orchestration tools (docker, podman, kubectl, helm,
snap, flatpak), and version managers (nvm, pyenv, asdf, and friends). These
findings continue to surface through the existing PKGBUILD security-review path so you
can review them before installing.

On the privilege side, command execution in the privileged and unprivileged
services was reworked, with Polkit detection added throughout ProcessExecutor,
XdgPaths, and AurPackageManager. Package searches and lookups now run as
unprivileged operations wherever possible, and a dedicated Polkit policy was
added for privileged Shelly CLI execution (with refined icon and prompt messaging).

📦 Package management — Providers & group queries

Shelly can now resolve virtual dependencies via providers, presenting a provider
selection when more than one package satisfies a dependency. The query command
gained a --group / -g option for searching package groups (it defaults to
searching available packages), making it easier to discover and inspect grouped
packages from the CLI.

🐚 CLI refactor continues

Console creation across the CLI now flows through a single ShellyConsoleFactory,
and RunShellyCommand and related execution paths in ProcessExecutor were
refactored for clarity and consistency. PKGBUILD parsing learned to surface local
source files, and Shelly now correctly reports when pacman hooks have run during
an operation.

🖥️ UI, AppImage & Flatpak

  • New grid layouts for the update and manage views, with reworked grid-selection logic.
  • An alternate install view and an animated intro page.
  • Continued Flatpak UI improvements and better handling of Flatpak progress callbacks.
  • AppImage fixes, including corrected Forgejo-hosted AppImage updates.
  • Fixed the updates count not appearing in the UI.
  • Desktop cache ownership fix and refined lockout-service behavior.
  • Removed the obsolete fingerprint warning and related UI elements.

🌍 Translations

This release ships a large localization update: refreshed Japanese, French
(fr_FR), Turkish (tr_TR), German (de_DE) translations, a new Italian
translation, and additional automated localization passes.

What's Changed

Contributors

A huge thank you to everyone who contributed to this release — 10 unique
contributors, 2 of them brand new to the project:

New Contributors

Full Changelog: v2.4.0.4...v2.4.1.0

Check out latest releases or
releases around Seafoam-Labs/Shelly-ALPM v2.4.1.0

Don't miss a new Shelly-ALPM release

NewReleases is sending notifications on new releases.

Get notifications