Look-for-regressions PR by omeritzics · Pull Request #408 · omeritzics/Updatium

omeritzics · 2026-07-09T17:35:23Z

Summary by CodeRabbit

New Features
- Added support for additional app sources, including Bitbucket, Gitea, OpenAPK, Signal, VLC, and Apk4Free.
- Added repository-rename detection, tarball filtering, DNS provider options, system-app visibility controls, and enhanced Safe Mode settings.
- Improved app filtering, sorting, and update-list organization.
- Expanded localization with new Greek, Filipino, Norwegian Bokmål, Tamil, and other translation updates.
Documentation
- Updated download guidance, supported sources, troubleshooting, screenshots, and community conduct information.
Security
- Added automated secret scanning and build provenance verification.

…ted casts in generated_form Phase 2B: Moved filter/sort/reorder logic from apps.dart into a pure AppListBuilder class in lib/components/app_list_builder.dart. Also moved AppsFilter class there to avoid circular imports. Reduces apps.dart build() method by ~150 lines. Phase 3A: Introduced 'final item = widget.items[r][e]' at the top of the generated_form build loop and replaced ~18 repeated casts with direct property access on the narrowed variable. Phase 3B: Fixed multi-line cast patterns that survived the replaceAll.

…ler methods Extracted: - _shareToAppVerifier(): self-contained AppVerifier sharing logic from installApk() - _resolveAppsToInstall(): app validation/sorting loop from downloadAndInstallLatestApps() into a method returning a Dart record (appsToInstall, trackOnlyAppsToUpdate)

→ in corrupt JSON log e is ClientException → err is ClientException in retry logic Bounds check apkUrls before preferredApkIndex access Copy SharedPreferences keys before removeWhere Null-safe pickedSource?.runtimeType Empty string guards in _splitAlphaNumeric and _isNumeric

- Add GoogleSans-Variable.ttf as the new primary font asset - Update font family configuration in pubspec.yaml - Replace font family references with GoogleSans in main.dart - Remove Hebrew language-specific font fallback logic - Update fontFamilyFallback lists to use GoogleSans as default

… and release.yml) Add debug APKs for Nightly build Refactor GitHub Actions workflows Updated workflow name and added caching for Flutter and Gradle dependencies. Introduced a prepare job to check for code changes and auto-fix linting issues. Create gitguardian.yaml Refactor nightly.yml for improved workflow and caching Refactor nightly workflow to include preparation job and caching for Flutter and Gradle dependencies. Added checks for code changes and auto-fix linting issues. Update ci.yml Remove key.properties verification step Removed verification step for key.properties and its contents. Remove key.properties verification step Removed verification step for key.properties and related environment variable checks. Change release tag name from 'nightly-build' to 'nightly' ci(workflow): remove disk space cleanup step from ubuntu runner Removed the `jlumbroso/free-disk-space` action step from the Ubuntu runner configuration in the CI workflow. This step was previously used to free up disk space during builds but has been removed to simplify the workflow configuration.

And update dependencies

Add some tests and improve existing ones

Update CODE_OF_CONDUCT.md Update CODE_OF_CONDUCT.md Update bug_report.md

Improve TV support style: auto-fix linting and formatting issues

Update strings Another update

Added a note about Safe Mode feature in README.

Updated contribution guidance and support options.

* Move "Source override" to source_provider * Update "Open Source" badge to include IzzyOnDroid * Revise openSourceNote * Update README

*Total -- 951.59kb -> 772.52kb (18.82%) /assets/screenshots/3.material_you.png -- 152.77kb -> 116.16kb (23.96%) /assets/screenshots/5.app_opts.png -- 187.20kb -> 143.78kb (23.2%) /assets/screenshots/2.dark_theme.png -- 147.44kb -> 115.47kb (21.68%) /assets/screenshots/4.app.png -- 139.96kb -> 111.35kb (20.44%) /assets/screenshots/1.apps.png -- 167.83kb -> 145.27kb (13.44%) /assets/screenshots/6.grid_view.png -- 156.39kb -> 140.49kb (10.16%) Signed-off-by: ImgBotApp <ImgBotHelp@gmail.com> Co-authored-by: ImgBotApp <ImgBotHelp@gmail.com>

Replaced setup-java action with system JRE installation.

✅ CI Build Passed - Automatically dismissing previous rejection as the build now succeeds.

codacy-production

Pull Request Overview

This PR is not up to quality standards. The implementation of the GitHub search filter introduces a critical N+1 network request pattern that will likely lead to immediate API rate limiting for users. Furthermore, a shell injection vulnerability was identified in the release workflow. The PR's scope is excessively broad, spanning core architecture, new app sources, CI/CD hardening, and UI/UX improvements, which increases regression risk—especially since complex logic in 'apps_provider.dart' lacks test coverage and is prone to OutOfMemory crashes. Acceptance criteria for Safe Mode password protection, GitHub repository rename detection, and DNS-over-HTTPS provider switching lack verifying test scenarios. The aggressive 'anti-cheat' logic in 'DeviceAdminReceiver.kt' also requires re-evaluation to ensure platform compliance and stability. These issues should be resolved before merging.

About this PR

Systemic code duplication between the Bitbucket and Gitea source providers suggests that repository search and release parsing logic should be abstracted into a common base class to improve maintainability.
The PR scope is extremely broad, combining core feature additions, CI/CD changes, documentation, and mass localization updates. This significantly increases regression risk and complicates the review process.
The PR title 'Look-for-regressions PR' is generic and does not reflect the significant feature additions, security hardening, and breaking changes such as the deep link scheme migration.

1 comment outside of the diff

.github/workflows/release.yml

_{line 66 🔴 HIGH RISK}
Using variable interpolation with 'github' context data in a 'run:' step can lead to shell injection. Map the context data to environment variables and use those variables with double quotes instead.

Test suggestions

Verify GitHub repository rename detection correctly identifies moved repos and prompts for URL update.
Test Safe Mode activation with password and verify it blocks the 'Add App' functionality.
Confirm DNS resolution works correctly when switching between different DoH providers in settings.
Verify that the new app sources (e.g., Bitbucket, Gitea) correctly parse versions and download APKs.
Test tarball (.tar.gz) extraction and APK filtering logic.
Verify Android TV specific UI focus and navigation (Shortcuts and TV-specific form focus).
Implement unit tests for 'lib/providers/apps_provider.dart' to cover complex archive extraction logic and prevent OOM regressions.
Implement unit tests for 'lib/providers/source_provider.dart' to address high complexity and lack of coverage.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify GitHub repository rename detection correctly identifies moved repos and prompts for URL update.
2. Test Safe Mode activation with password and verify it blocks the 'Add App' functionality.
3. Confirm DNS resolution works correctly when switching between different DoH providers in settings.
4. Test tarball (.tar.gz) extraction and APK filtering logic.
5. Verify Android TV specific UI focus and navigation (Shortcuts and TV-specific form focus).
6. Implement unit tests for 'lib/providers/apps_provider.dart' to cover complex archive extraction logic and prevent OOM regressions.
7. Implement unit tests for 'lib/providers/source_provider.dart' to address high complexity and lack of coverage.

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-07-12T12:32:45Z

+    String filePath,
+    String destinationPath,
+  ) async {
+    final bytes = await File(filePath).readAsBytes();


_{🔴 HIGH RISK}

The 'extractTarballFile' method reads the entire archive into memory as a byte array, which will result in 'OutOfMemoryError' crashes on mobile devices for large archives. Refactor this to use a streaming approach with 'InputFileStream' from the archive package.

codacy-production · 2026-07-12T12:32:45Z

+        String url = entry.key;
+        // Extract owner/repo from https://github.com/owner/repo
+        String repoFullName = url
+            .substring('https://${hosts[0]}'.length)
+            .split('?')[0]
+            .split('#')[0];
+
+        try {
+          Response res = await sourceRequest(
+            '${await getAPIHost({})}/repos/$repoFullName/releases',
+            {},
+          );
+          if (res.statusCode == 200) {
+            var releases = jsonDecode(res.body) as List<dynamic>;
+            if (releases.isNotEmpty) {
+              return entry;
+            }
+          }
+        } catch (e) {
+          // Ignore errors and filter out
+        }
+        return null;
      });


_{🔴 HIGH RISK}

This implementation introduces an N+1 network request pattern during search when 'filterGitHubReleases' is enabled. This will significantly slow down search results and may cause users to hit GitHub API rate limits almost immediately. Instead of verifying all search results concurrently, fetch release data only when a specific app is selected, or implement strict batching and throttling.

codacy-production · 2026-07-12T12:32:45Z

+                @Suppress("DEPRECATION")
+                activityManager.killBackgroundProcesses(packageName)
+            }
+        } catch (e: Exception) {


_{🟡 MEDIUM RISK}

Catching a generic Exception can obscure the underlying cause of failure when interacting with system services. Consider catching specific exceptions like 'SecurityException' and 'RemoteException', and use a logging utility instead of 'e.printStackTrace()'.

codacy-production · 2026-07-12T12:32:46Z

@@ -266,6 +279,58 @@ class GitHub extends AppSource {
  ) async =>


_{🟡 MEDIUM RISK}

The logic to inject 'GHReqPrefix' into API requests has been removed, but the setting remains in the configuration UI. Users relying on GitHub proxies will find the functionality broken; restore the logic in the 'getAPIHost' method.

codacy-production · 2026-07-12T12:32:46Z

+      switch (targetProvider) {
+        case DNSProvider.system:
+          // System default - use Google's constructor as base
+          _dnsOverHttps = DnsOverHttps.google();


_{🟡 MEDIUM RISK}

When 'system' is selected, the service should bypass the DoH client to use the device's native DNS resolution instead of hardcoding Google's DoH servers, which may bypass local network configurations and impact privacy.

codacy-production · 2026-07-12T12:32:46Z

+    splits {
+        abi {
+            isEnable = true
+            reset()
+            include("arm64-v8a", "armeabi-v7a")
+            isUniversalApk = false
+        }
+    }
+    */


_{🟡 MEDIUM RISK}

ABI splits are commented out in the Gradle configuration, but the CI scripts (ci.yml, nightly.yml) are configured to expect split-per-abi outputs. This will likely cause build or artifact collection failures.

codacy-production · 2026-07-12T12:32:46Z

                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />
-                <data android:scheme="obtainium" />
+                <data android:scheme="updatium" />


_{🟡 MEDIUM RISK}

Suggestion: Changing the URI scheme from 'obtainium' to 'updatium' is a breaking change for existing deep links. Ensure there is a migration strategy or documentation for users relying on 'obtainium://' links.

codacy-production · 2026-07-12T12:32:46Z

+                  (e.key == list.length - 1
+                      ? ''
+                      : e.key == list.length - 2
+                      ? '${isUsingEnglish ? ',' : ''} and '


_{⚪ LOW RISK}

Replace the hardcoded ' and ' string literal with a call to the 'and' translation key to ensure proper localization in non-English languages.

codacy-production · 2026-07-12T12:32:46Z

+
+# Configuration
+PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BUILD_DIR="${PROJECT_DIR}/build"


_{⚪ LOW RISK}

Nitpick: The variable 'BUILD_DIR' is assigned but never used. If it is not required for external processes, it should be removed.

…ving deprecated workflows - Update actions/attest to v4.1.1 in nightly and release workflows - Pin actions/checkout to v6.0.2 in validate-translations workflow - Pin jlumbroso/free-disk-space to v1.3.1 in release workflow - Remove deprecated translation-validate.yaml workflow - Remove unused apk4free.dart source file - Remove buildAdvancedSettingsWidget from AppSource class - Fix SourceForge URL regex pattern - Fix boolean string comparison in release workflow prerelease condition

github-actions

🚫 CI Build Failed

The automated build process failed. Please review the build logs and fix the issues before requesting another review.

Next steps:

Check the build logs for specific errors
Fix the identified issues
Push your fixes to this branch
The CI will automatically re-run

Once the build passes, this review will be dismissed automatically.

…tency - Added APK filtering configuration options (apkFilterRegEx, invertAPKFilter) - Added appId validation with regex pattern - Improved state management in AddAppPage by splitting loading states - Enhanced UI consistency with consistent icon sizing (48px) and padding adjustments - Combined explanation text in settings for better readability - Added DNS service test suite and test utilities BREAKING CHANGE: Removed deprecated `advancedAppSpecificSourceAgnosticSettingFormItems` and `combinedAdvancedSettingFormItems` properties from AppSource

✅ CI Build Passed - Automatically dismissing previous rejection as the build now succeeds.

… sources dialog

github-actions

🚫 CI Build Failed

The automated build process failed. Please review the build logs and fix the issues before requesting another review.

Next steps:

Check the build logs for specific errors
Fix the identified issues
Push your fixes to this branch
The CI will automatically re-run

Once the build passes, this review will be dismissed automatically.

Replace custom installed apps retrieval with android_package_manager package for improved reliability and functionality. The new implementation uses getAllInstalledInfo() to fetch installed applications with better compatibility and metadata access. BREAKING CHANGE: The installed apps dialog now uses android_package_manager and may display different apps or behavior compared to the previous implementation

- Replace prefetch-first-N with on-demand loading via _onNeedLoad - Remove isPrefetching state and prefetching logic - Update InstalledAppTile to accept onNeedLoad callback - Adjust icon sizes from 14 to 16 in apps page - Refactor grid view layout in apps page from SliverGrid to Wrap - Adjust tile padding and spacing for improved UI consistency

✅ CI Build Passed - Automatically dismissing previous rejection as the build now succeeds.

Update APKMirror source description in README to indicate it is now track-only. Add enforceTrackOnly setting in APKMirror source configuration.

github-actions

🚫 CI Build Failed

The automated build process failed. Please review the build logs and fix the issues before requesting another review.

Next steps:

Check the build logs for specific errors
Fix the identified issues
Push your fixes to this branch
The CI will automatically re-run

Once the build passes, this review will be dismissed automatically.

Imran Remtulla and others added 30 commits June 24, 2026 03:14

Switch to adaptive icon

a017d16

And update dependencies

Show the real author when choosing apps from F-Droid (#310)

3d48beb

Fix Updatium thinks is outdated when it is up-to-date

904647d

Add some tests and improve existing ones

99921ab

Add some tests and improve existing ones

Add Code of Conduct

0aabc7d

Update CODE_OF_CONDUCT.md Update CODE_OF_CONDUCT.md Update bug_report.md

Improve TV support

73aecbf

Improve TV support style: auto-fix linting and formatting issues

Update Hebrew

9de247f

Update strings Another update

style: auto-fix linting and formatting issues

e2b496c

Document Safe Mode feature in README

c67bd97

Added a note about Safe Mode feature in README.

Add reference toused open sources packages

db903ca

style: auto-fix linting and formatting issues

4e73080

Add initial "Trusted" badge for FOSS sources and official sources

d7ddecb

style: auto-fix linting and formatting issues

8ecd861

Reorder some options in source_provider.dart

05a732a

Revise contribution information in README

dc48661

Updated contribution guidance and support options.

Update README

e612f33

* Move "Source override" to source_provider * Update "Open Source" badge to include IzzyOnDroid * Revise openSourceNote * Update README

Update screenshot

6eff74d

style: auto-fix linting and formatting issues

c0eddbe

Fix potential issues

ee8f758

style: auto-fix linting and formatting issues

e997a78

Delete build.sh

c3e7457

Change Java setup method in nightly workflow

888d21c

Replaced setup-java action with system JRE installation.

Attempt to fix displaying Trad. Chinese

a70e784

style: auto-fix linting and formatting issues

5fcc20a

style: auto-fix linting and formatting issues

a8e4548

codacy-production Bot reviewed Jul 12, 2026

View reviewed changes

github-actions Bot previously requested changes Jul 12, 2026

View reviewed changes

omeritzics and others added 5 commits July 12, 2026 17:10

Improve tests

d0b7650

style: auto-fix linting and formatting issues

891ef05

Update Flutter

4e4e228

style: auto-fix linting and formatting issues

c76d762

omeritzics added 2 commits July 12, 2026 22:25

Fix hardcoded strings

263743c

fix: Fix overlapping of long app source name strings in the supported…

80c5d68

… sources dialog

omeritzics force-pushed the main branch from 7710c45 to 80c5d68 Compare July 12, 2026 19:31

omeritzics and others added 3 commits July 12, 2026 19:32

style: auto-fix linting and formatting issues

43d590e

Cancellations are not errors

8bbc0a2

style: auto-fix linting and formatting issues

f264f3f

github-actions Bot previously requested changes Jul 12, 2026

View reviewed changes

omeritzics and others added 6 commits July 12, 2026 23:04

Comment out the open source badge for now

9cf1d55

design: Update AMOLED theme

520ab36

style: auto-fix linting and formatting issues

56f3ab9

style: auto-fix linting and formatting issues

f1885b4

docs(readme): update APKMirror source description to track-only

2785b80

Update APKMirror source description in README to indicate it is now track-only. Add enforceTrackOnly setting in APKMirror source configuration.

github-actions Bot requested changes Jul 13, 2026

View reviewed changes

omeritzics and others added 2 commits July 13, 2026 22:36

ui: Update spacing

075cd3f

style: auto-fix linting and formatting issues

92e56f6

omeritzics closed this Jul 13, 2026

		@@ -266,6 +279,58 @@ class GitHub extends AppSource {
		) async =>

Conversation

omeritzics commented Jul 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

codacy-production Bot left a comment • edited by omeritzics Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codacy-production Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

omeritzics commented Jul 9, 2026 •

edited by coderabbitai Bot

Loading

codacy-production Bot left a comment •

edited by omeritzics

Loading