Still no follow-up on aur-general ten days after aurweb v6.5.0 restored AUR pushes and package adoption. Registration remains closed, while adoption requests require Package Maintainer approval and expire after 14 days if unanswered.

These controls mitigate the orphan-package takeover path, but they do not make every AUR update trustworthy. Continue reviewing unfamiliar PKGBUILDs — especially packages with recent maintainer changes — before building them. For the background and practical audit steps, see The AUR Is Frozen: Inside Arch’s Third Supply-Chain Attack Wave.