Skip to content

BetterPullReview v0.3.3

Choose a tag to compare

View all tags
@MikeMarcin MikeMarcin released this 25 Oct 03:16
· 513 commits to main since this release
v0.3.3
193ed10

BetterPullReview 0.3.3

Download and install

System Download
macOS 14.4+ · Apple Silicon and Intel Download DMG
Windows · x64 Download MSI
Ubuntu 26.04 · x64 Download DEB

The selected test environments are Windows 11 and Ubuntu 26.04 under WSL2/WSLg.
Other Windows and Linux environments may work but are untested; the packages
do not reject them. Full agent integrations and local automation are included.
On Ubuntu, download
and verify the matching .deb.asc signature before installing.

Changes since 0.3.1

  • Set up an installed coding agent in the Agent drawer, choose or change the
    agent and repository workspace, and reuse linked clone history. Clone folders
    in Settings help locate existing checkouts. Each agent has its own session;
    findings can be saved as private notes.

  • React to comments and reviews, remove your reaction, and resolve or reopen
    conversations from the drawer. Reply to outdated threads from the drawer;
    thread replies also work through the configured GitHub CLI connection.

  • Drawer tabs, thread cards and agent setup retain their wording and actions
    as the available width changes.

  • Home can recover a requested-reviewer read that exceeds the REST response
    bounds through a bounded, projected GraphQL roster. It verifies the exact PR
    and the complete list of directly requested users before adopting the result;
    unavailable or failed recovery remains an explicit refresh failure.

  • Filter a pull request's review by individual commits or selected commit ranges
    from the new Commits tab. Filter chips show the active selection. When a hidden
    commit separates selected changes to one file, read each selected commit’s diff
    separately. After a force push, review offers to rematch hidden changes.

  • Set generated files aside and filter the file list. The review reads
    linguist-generated from the head commit's .gitattributes; files you mark
    yourself keep their review state locally. Open a set-aside generated file’s
    diff when you need to inspect it.

  • Edit a suggested change directly in the head pane, keep its draft, and carry
    or copy a kept suggestion when the pull request moves to a newer head.

  • Select several pending comments or Find in files results and copy them with
    their file names and lines. Search results can open in a new tab.

  • Add comments and suggestions to a selected line range from its context menu.

  • See your own review verdict on Home. A review GitHub refuses returns its
    drafts so they can be corrected and submitted again.

  • Mark all comments in a pull request as read, or mark comments from one author
    as read. New posts and later edits still count as new.

  • With no review in progress, the review bar says Approve or comment… to make
    the whole-review actions easier to find.

  • Configure known C++ namespaces, including std by default.

  • Export recent diagnostics as a ZIP with capacity for a day of heavy use.

  • Open Help > About BetterPullReview for version information, project links,
    and installed licence and source-offer documents.

  • Ignore a pull request on Home and restore it from the collapsed Ignored list.

  • Opening a pull request while Home discovery is loading takes priority.
    Discovery avoids repeated reads and batches retained pull-request refreshes.

  • The + button opens a draft even when the pull request has no threads.
    Files and Repositories drawers have their own command keys, and Overview can
    jump to the top or bottom of its files.

  • The update panel shows formatted release notes and can check public releases
    without a GitHub.com sign-in. Update settings retain that access choice.

  • Review history startup reuses verified Git configuration while other Git
    commands are reading it, avoiding a Windows file-sharing refusal.

  • Preserve the latest selected line when a tab is still loading or the window
    closes immediately after navigation. Superseded tab loads no longer reset a
    newer line selected in the same comparison.

  • Sensitive storage erasure remains complete in optimized builds.

Verification and distribution

Each platform supplies checksums, SPDX and a separate exact-version
corresponding-source archive. Binary and source access are public through the
same release channel at no additional charge. Corporate/offline redistribution
must include the exact source asset. Source, digests and tags are retained
immutably and indefinitely until all applicable obligations have ended.

macOS uses Developer ID signing and notarization. Windows uses a per-user MSI;
the runtime ZIP is an inventory archive. Ubuntu 26.04 uses a signed DEB and a
per-user archive requiring system dependencies; WSL2 production does not qualify
ordinary-user installation, authentication, vault and removal by itself.
Its private ICU 73.2 libraries retain pinned source and
recipient rebuild instructions.

Linux signature verification

The Ubuntu artifacts have detached OpenPGP signatures. Save the complete public
key block below as bpr-release-signing.asc. Its SHA-256 is
c271732f02b5f3c709ad1a61d7f7816200e96226c490fd77d88f6583437f9798.
The approved full fingerprint is
ED85BAA84A3B6D83FCD5B1F107CEC96F2688E4A8.

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEasxxjBYJKwYBBAHaRw8BAQdA9KNHnT4d1R2udPXayFCA+/25zFrtQ19mKfZH
egF0Pj20IEJldHRlclB1bGxSZXZpZXcgUmVsZWFzZSBTaWduaW5niJYEExYKAD4W
IQTthbqoSjttg/zVsfEHzslvJojkqAUCasxxjAIbAwUJA8MjpAULCQgHAgYVCgkI
CwIEFgIDAQIeAQIXgAAKCRAHzslvJojkqGLgAQDOsFQeotQcvzDKZ5EyOV5RG9hs
L7mR9PeQBHVq6fsJYAEA90e/kJyl1nPfTaPkxcKVNZPF6iq8KZLsFurdYT4RfQA=
=GIqv
-----END PGP PUBLIC KEY BLOCK-----

Check the saved key's digest and fingerprint before importing it:

sha256sum bpr-release-signing.asc
gpg --show-keys --with-fingerprint bpr-release-signing.asc
gpg --import bpr-release-signing.asc

For each of the six signed Ubuntu products—the DEB, user archive, SPDX,
corresponding-source ZIP, checksum file and provenance—download its matching
.asc signature and run gpg --verify ARTIFACT.asc ARTIFACT, replacing both
names with that exact file. The .release.json manifest is verification
metadata and has no detached signature of its own.
Require a good signature from the full fingerprint above before installation
or use. A detached DEB signature is verified separately; dpkg does not enforce
it. This public key and fingerprint are supplied through the same public
release channel as the signed artifacts.

Known limitations

RFC-BPR-0038 remains open. Clean-account installation, authentication and
platform vaults, native Intel and full ordinary-user Windows 11/Ubuntu WSLg courses,
accessibility, upgrade/removal, resident-material crash privacy, external
hardening and complete vulnerability/fuzz coverage remain incomplete.
Profile purge excludes shared updater/registry state and is not uninstall.

The earlier Ubuntu RSS-growth failure is retained in BPR-1653. The owner
approved a 240 MiB process RSS-growth criterion alongside the independent
216 MiB live-heap limit, and the card's complete current-source course passed.
The v0.3.1 exception is not extended. This release's exact native resource,
artifact and security results require their own qualification.
Historical findings and dispositions retain only their original scope.

Installed source-offer clarification: a sentence describing private repository access remains from earlier releases. This release supplies binaries and their exact corresponding-source assets publicly through the same channel at no additional charge. The exact source URLs and digests, redistribution duties, original-channel fallback and indefinite immutable retention remain in force.

The GHES repair is based on the supplied anonymized failure: requested-reviewer
loading returned HTTP 200 and then a response-limit failure. It does not claim
the private server's exact byte, structural or record guard was identified.
No further diagnostic handoff is a prerequisite for this release; deterministic
provider regressions and the selected native release gates supply its validation.

v0.3.3 qualification exceptions

The owner accepted these limitations specifically for v0.3.3. They remain failed or skipped evidence, not passing tests:

  • Windows Debug timed out in the 200% diff workbench course and all three pull-request Find scales. Follow-up investigation is tracked separately.
  • Ubuntu Release application_large_review_resources and application_large_review_loaded_close exceeded the unchanged 168 MiB footprint-growth limits. Two validated image-storage improvements passed their owning/rendering controls, but did not close those memory-budget failures. The owner waived the remaining memory-budget failures for this release.
  • The large-review cache-byte course is configured to skip in Debug. Other configured skips retain their recorded scope.

Unaffected passing native tests are retained with their original source/configuration identities; affected checks and final packages have separate fresh evidence. The native, vault, installation, crash-privacy, external-hardening, vulnerability-mapping and bounded-fuzz limitations above remain open. Artifact signatures, source/SPDX binding and native trust checks are separate from these test exceptions.

The Windows vulnerability report retains three Qt bundled-zlib entries for CVE-2026-85091 under the existing named owner deferral through Qt 6.12 until an official Qt release fixes it. Current source and native call/export review found no caller for its required nonblocking gzip-file-write/printf sequence; the library is not claimed fixed. Raw scanner failures and incomplete coverage remain recorded. The exact scope is in the release security policy.

Assets 30
Loading