package updates and self updating

cheapnud commented

2026-08-22 12:05:25 +00:00

Owner

Updates all packages and wires the new self-update support: the app checks the forge feed on startup and shows a restart chip when a new version is downloaded. bunit stays pinned at 2.7.2 over an upstream hang.

cheapnud added 4 commits

2026-08-22 12:05:25 +00:00

update packages 978aee3f06

bump CheapAvaloniaBlazor, CheapHelpers family, MudBlazor, Mapster, EF Core, and test SDK packages to latest. xunit.runner.visualstudio bumped to 4.0.0. bunit stays pinned at 2.7.2: 2.9.0 pulls in AngleSharp 1.7.0 and hangs an existing finishing-scan test (the async continuation after an EF await never resumes, so bunit's render-triggered WaitForAssertionAsync times out with zero renders observed).

add self updates with a restart chip 9d89fe8990

wire WithVelopackUpdates against the forge repo and show a small update-ready chip in the app bar that hands off to the update service's restart. the host already runs the background check and download itself once configured, so the layout just observes the ready state and applies it on click. no update service configured or installed (dev runs) means no chip and no crash.

ledger the update feed transport risk 6db70079b1

tick the velopack wiring item

Claude PR Review / AI Code Review (pull_request) Successful in 16s

Details

Build & Test / Build and Test (pull_request) Successful in 7m40s

Details

19af48ee63

forgejo-actions commented

2026-08-22 12:05:41 +00:00

🤖 Claude AI Code Review

Summary
Bumps package versions and wires Velopack self-update, adding a restart chip to the app bar with test coverage. The plaintext HTTP feed is a known/documented risk.
Code Quality ⭐⭐⭐⭐☆
Clean implementation with good handling of the subscribe/first-render race and proper IDisposable cleanup; well-tested via a fake service.
Issues

🟡 Program.cs — the update feed uses plaintext HTTP over the LAN, which allows MITM → arbitrary code execution on update. The PR author already documented this in TODO.md as an accepted risk pending TLS/signing, so it's a conscious tradeoff rather than an oversight, but it remains a real security exposure worth surfacing at merge time.

🟢 MainLayout.razor — OnAfterRenderAsync wraps Updates.StateChanged += ... in a try/catch, but if subscription throws, the handler is never attached and Dispose unsubscribing a never-subscribed handler is harmless. Minor: the catch only logs to Debug.WriteLine, so failures are silent in release. Not blocking.

Verdict: APPROVE

The code is well-structured and tested. The HTTP feed security risk is real but explicitly acknowledged and tracked as a follow-up infra/upstream item, so it's a deliberate decision rather than a blocker.

📊 Tokens: 6920 input + 484 output | 💰 Cost: ~$0.0467
Generated by Claude Opus 4.8 via Gitea Actions

## 🤖 Claude AI Code Review 1. **Summary** Bumps package versions and wires Velopack self-update, adding a restart chip to the app bar with test coverage. The plaintext HTTP feed is a known/documented risk. 2. **Code Quality** ⭐⭐⭐⭐☆ Clean implementation with good handling of the subscribe/first-render race and proper `IDisposable` cleanup; well-tested via a fake service. 3. **Issues** 🟡 Program.cs — the update feed uses plaintext HTTP over the LAN, which allows MITM → arbitrary code execution on update. The PR author already documented this in TODO.md as an accepted risk pending TLS/signing, so it's a conscious tradeoff rather than an oversight, but it remains a real security exposure worth surfacing at merge time. 🟢 MainLayout.razor — `OnAfterRenderAsync` wraps `Updates.StateChanged += ...` in a try/catch, but if subscription throws, the handler is never attached and `Dispose` unsubscribing a never-subscribed handler is harmless. Minor: the catch only logs to `Debug.WriteLine`, so failures are silent in release. Not blocking. 4. **Verdict**: **APPROVE** The code is well-structured and tested. The HTTP feed security risk is real but explicitly acknowledged and tracked as a follow-up infra/upstream item, so it's a deliberate decision rather than a blocker. --- 📊 **Tokens**: 6920 input + 484 output | 💰 **Cost**: ~$0.0467 *Generated by Claude Opus 4.8 via Gitea Actions*

cheapnud merged commit 85ca830920 into master

2026-08-22 12:13:31 +00:00

cheapnud referenced this pull request from a commit

2026-08-22 12:13:32 +00:00

Merge pull request 'package updates and self updating' (#7) from d/velopack-updates into master

Rows
Columns

package updates and self updating #7

🤖 Claude AI Code Review