New plugin: System Updates Manager

[tordex]

Plugin

• Id: tordex/system-updater
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Manage system updates inside the noctalia panel. Check for new updates using PackageKit, Flatpak and Cargo. Install updated packages.

External dependencies

• python for check update scripts. Required python modules pycairo and PyGObject. Install using pip install pycairo PyGObject.
• pkgcli the PackageKit cli utility to check/install updates using PackageKit
• cargo and cargo-install-update to check/install updates using Cargo
• flatpak to check/install updates using Flatpak

Testing

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against: 5.0.0_beta.8
• Plugin API level: 20

Screenshots / Videos

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[ItsLemmy]

1. blocking - system-updater/service.luau:399

The selected package ID is substituted directly into an adapter command, then executed as a shell string through
noctalia.runStream at system-updater/service.luau:345. Package IDs originate from adapter output at
system-updater/panel.luau:105 and are neither quoted nor validated. A crafted ID can append shell syntax and execute arbitrary commands in the user's session. Use an argv-based execution path, or strictly validate and shell-quote the replacement before launch.

2. blocking - system-updater/widget.luau:26

render() dereferences state.error even when state is nil. system-updater/widget.luau:60 reads the shared state
immediately and line 61 calls render(). The host returns nil when the service has not published the key yet, so
startup or reload ordering can terminate widget initialization before the state watcher recovers. Guard this access
as already done for phase and pending state.

3. non-blocking - system-updater/plugin.toml:7

The Cargo checker invokes bash and awk at system-updater/adapters/cargo/check.py:7, but neither command is declared in the manifest, the Cargo adapter dependency list at system-updater/adapters/cargo/adapter.json:4, or the README requirements. On a system missing either command, the adapter can be enabled despite an unmet runtime dependency. Declare them or replace the shell pipeline with Python parsing.

[tordex]

Added package name validation, fixed the nil state and added bash and awk to dependencies.