Repository navigation
fix(windows): check for updates through the release download links, not GitHub's API - #50
Merged
Merged
Conversation
…ot GitHub's API GithubSource lists the releases through GitHub's API, which allows 60 requests an hour per address without a token, shared by everyone behind the same NAT, so the check failed with 403 (rate limit exceeded). LatestReleaseUpdateManager reads releases/latest/download/ with SimpleWebSource instead. The latest release's feed only holds the delta from the release before, so an installation further behind takes the full package rather than a delta applied to the wrong base. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Response status code does not indicate success: 403 (rate limit exceeded).Velopack'sGithubSourcelists the releases through GitHub's API, and without a token that API allows 60 requests an hour per source address. Everyone behind the same NAT (an office network, a VPN) shares those 60, and so do other tools that call the API without a token. On the machine where this was reported,https://api.github.com/rate_limitshowedcoreat 60/60 used. A token cannot be shipped in the app.LatestReleaseUpdateManager(Preferis.Platform.Windows, Windows only underVELOPACK): anUpdateManageroverSimpleWebSource("https://github.com/Cysharp/Preferis/releases/latest/download/"). GitHub redirectsreleases/latest/download/<file>to that file of the latest release, which skips drafts and prereleases asprerelease: falsedid, and does not go through the API.VelopackUpdaterin the settings app now uses it.GithubSourcemerged the feeds of the last 10 releases, so an installation several versions behind could chain deltas. The latest release's feed only lists whatPackageWindowspacked with it: its full and delta packages, plus the full package of the release before, whichvpk download githubfetched to make the delta. Velopack would apply that one delta to an older installation as well. Files the delta marks as unchanged would then stay at the installed version, and Velopack does not verify the patched result.CreateDeltaUpdateStrategyis overridden so deltas are used only when the feed has the installed version's full package, which means the installation is exactly one release behind. Anything older downloads the full package.Verification
dotnet test Preferis.Windows.slnf -p:Platform=x64: 984 passed (Core 606, Platform 134, Settings.Core 244), including the 3 newLatestReleaseUpdateManagerTests(written first and seen failing).dotnet build src/Preferis.Settings.Windows -p:Platform=x64: 0 warnings, 0 errors.releases/latest/download/releases.win-x64.jsonwith the query stringSimpleWebSourceappends (arch,os,rid,id,localVersion) returns the 1.0.0 feed (HTTP 200).PackageWindows).🤖 Generated with Claude Code