The AUR Is Frozen: Inside Arch's Third Supply-Chain Attack Wave
If you fired up yay -Syu over the past week and noticed your AUR packages silently refusing to update, you’re not imagining it — and it isn’t a bug in your helper. As of August 1, 2026, Arch Linux disabled all pushes to the Arch User Repository, meaning maintainers could no longer publish updates, new versions, or fixes to the community package collection that most of us rely on daily. The AUR stayed up and readable, but writes were locked down while the project fought off its third supply-chain attack since June. ...