Arch Linux paru¶

ID: paru
Link: Repository
Upstream stars: ⭐ 9,000
Last commit: 2026-01-09
Version requirement: >= 1.9.3
Cooldown: ✓
Platforms: 🅱️ BSD · 🐧 Linux · ⨂ Unix
Operations: installed · outdated · orphans · search · install · upgrade · upgrade_all · remove · sync · cleanup · doctor
purl types: pkg:alpm/ · pkg:paru/
CLI name: paru
Every call: paru --noconfirm --color never <command>
Issues and PRs: 📦 manager: pacman-based
Source: pacman.py

AUR helper wrapping pacman, driven through the paru binary.

Inherits every operation, parser and forced argument from Pacman; the binary, the version probe and the per-package cooldown probe below are what differ. Its own --query --upgrades reports AUR updates on top of the official repositories. The >=1.9.3 floor is the first paru release to implement --sysupgrade, the flag the inherited upgrade_all_cli builds.

Unlike pacman, the helper must run as the regular user: any transaction building AUR packages aborts under root (can't install AUR package as root), and paru invokes sudo pacman itself for the privileged steps. mpm therefore never wraps it in sudo.

What `mpm` adds to `paru`¶

Through mpm, paru gains:

a one-command cleanup --orphans that removes every orphaned dependency at once
--extended search, to match against package descriptions

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover paru alongside aura, dkp-pacman, pacaur, pacman, pamac, pikaur, shelly, trizen, yay and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `paru` commands, in `mpm`¶

You already know paru: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `paru`	With `mpm`
List what’s installed	`pacman --query`	`mpm --paru installed`
List outdated packages	`pacman --query --upgrades`	`mpm --paru outdated`
Search for a package	`pacman --sync --search fire`	`mpm --paru search fire`
Install a package	`sudo pacman --sync firefox`	`mpm install pkg:paru/firefox`
Upgrade one package	`sudo pacman --sync firefox`	`mpm --paru upgrade firefox`
Upgrade everything	`sudo pacman --sync --refresh --sysupgrade`	`mpm --paru upgrade --all`
Remove a package	`sudo pacman --remove firefox`	`mpm remove pkg:paru/firefox`
List orphaned dependencies	`pacman --query --deps --unrequired`	`mpm --paru orphans`
Clear caches	`sudo pacman --sync --clean --clean`	`mpm --paru cleanup --cache`
Run health checks	`pacman --database --check`	`mpm --paru doctor`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✅
`outdated`	✅	Only packages tracked in a sync database are reported; foreign packages (AUR builds, `-U` installs) stay invisible to the plain `pacman` binary.
`orphans`	✅
`search`	✅	Extended search backfilled by `mpm`.
`install`	✅	A package already installed as a dependency is marked explicit by `mpm`.
`upgrade`	✅
`upgrade_all`	✅
`remove`	✅	The `--orphans` flag also drops the package’s orphaned dependencies.
`sync`	✅
`cleanup`	✅	The `--orphans` sweep is backfilled by `mpm`.
`doctor`	✅

Configuration¶

Ignore paru on the mpm CLI by passing the --no-paru option.
Ignore it for every run in your configuration:
```
[mpm]
paru = false
```
Raise the timeout of all paru calls:
```
[mpm.overrides.paru]
timeout = 900
```

Run mpm config-template paru to print all overridable settings for your configuration file:

[mpm.overrides.paru]
cli_names = [
    "paru",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = [
    "--noconfirm",
    "--color",
    "never",
]
pre_cmds = []
requirement = ">=1.9.3"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "paru\\s+v(?P<version>\\S+)",
]

The arguments and environment variables listed in the box atop this page are forced on every paru call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes¶

A few jobs you would otherwise script around paru, one mpm command each:

Snapshot and clone a machine: mpm --paru dump paru.toml, then mpm restore paru.toml on the next one.
Export a compliance SBOM: mpm --paru sbom (CycloneDX by default, --spdx for SPDX).
Gate CI on health: mpm --paru doctor relays Arch Linux paru’s own diagnosis and exits non-zero on trouble.

Privilege escalation¶

Arch Linux paru runs sudo from inside its own commands: mpm never wraps it, keeps an already-warm credential cache alive for those internal escalations, and warns when a mutating call goes silent on a terminal with a cold cache, since a password prompt may be hiding in the stream.

See privilege escalation for the full policy.

Concurrency¶

mpm never runs paru at the same time as aura, pacaur, pacman, pamac, pikaur, trizen or yay: they all reach the pacman database (/var/lib/pacman/db.lck), and two of them mutating at once fail to init their transaction. Each mutating operation waits for the previous one, even with a higher --jobs, while managers outside this group keep running in parallel.

Only mutations are held back. The read-only queries (installed, outdated, search) take no backend lock and stay fully concurrent.

Cooldown¶

mpm enforces its release-age cooldown on Arch Linux paru with its own per-package probe: before an install or upgrade, it reads the publication date of the package’s latest release and holds back any release younger than the window (mpm --cooldown 7 --paru upgrade --all skips anything published in the last 7 days): a guard against a compromised or yanked fresh release landing before anyone notices.

Status: ✅ Enforced (mpm per-package probe, AUR half)
Mechanism: AUR LastModified read by paru --sync --info; held packages ride --ignore
Reference: AUR RPC

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: AUR
Retraction: None at the version level: an AUR package is a git repository with no per-version artifact to withdraw, so remediation is a maintainer push or deletion of the whole package
Publish date: ✅ server-set LastModified, the push timestamp mpm’s yay overlay and paru probe gate on. Git commit dates are client-set (GIT_COMMITTER_DATE), forgeable, and never consulted

Version check¶

The version is probed by running:

$ paru --version
paru v1.10.0 - libalpm v13.0.1

and extracted with:

r"paru\s+v(?P<version>\S+)"

Upstream project¶

Metrics	`Morganamilo/paru`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Gate paru’s AUR half under --cooldown: too-fresh AUR packages, dated by the RPC’s LastModified, are held out of the --sysupgrade transaction with --ignore.
- Mark a package already installed as a dependency as explicitly installed when mpm install or mpm restore names it, so mpm cleanup --orphans keeps it.
- Stop running the AUR helpers concurrently with pacman and with each other, all of them driving the same pacman database.
7.4.0 (2026-07-25)
- The AUR helpers are no longer wrapped in sudo: they refuse or break under root (makepkg rejects root builds, paru aborts AUR transactions, pacaur aborts its sync operations) and escalate through their own internal sudo pacman calls, which mpm now tracks with the internal_sudo marker (warm credential-cache keepalive, hidden-prompt watchdog). This also lets yay’s cooldown environment overlay reach the process, where the sudo wrap used to strip it.
6.2.0 (2026-03-25)
- Add --color never option to all invocations.
5.3.0 (2022-06-25)
- Add paru support.
- Run install, upgrade, remove and cleanup operations with sudo.