Skip to content

Querya Desktop 0.4.11-b

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Jul 19:45
· 1394 commits to main since this release
0.4.11-b
32c263a

[0.4.11-b] - 2026-07-27

Post-0.4.11 patch that ships security + Linux distro packaging (intended for 0.4.11-a), plus performance bounds (#414), UI reliability (#445), and code-review correctness (#463).

Note: GitHub tag 0.4.11-a was mistakenly placed on the same commit as 0.4.11, so those binaries did not include the 0.4.11-a changelog. Treat 0.4.11-b as the first patch after 0.4.11.

Added

  • Linux distro packaging (#386) — .rpm, Flatpak (.flatpak bundle + manifest), and AUR PKGBUILD; Release CI publishes rpm + Flatpak alongside existing .deb / AppImage — see packaging.md.

Security

  • Theme remote install localhost (#399) — ThemeRemoteInstallService defaults allowLocalhostInDebug to kDebugMode.
  • Archive path guard (#401) — zip extraction uses p.isWithin() bounds checks (archive_path_guard.dart).
  • Marketplace SHA256 (#396) — HttpMarketplaceRepository requires manifest checksum before install.
  • Marketplace download URLs (#397) — HTTPS allowlist / SSRF policy (MarketplaceDownloadPolicy).
  • Safe zip extraction (#398) — shared zip-bomb limits via SafeZipExtractor (extensions, updater, themes).
  • Remote theme SHA256 (#400) — remote theme install requires checksum when provided by metadata.
  • Sandbox OS consent (#395) — fail-closed unsandboxed driver launch without OS wrapper (bubblewrap / consent dialog).
  • Sideload integrity UX (#402) — local .zip/.qext install dialog with security notice and optional SHA256.

Performance

  • SQL result caps (#415 / #416) — SQLite injects LIMIT before materializing rows; Postgres clamps oversized LIMIT / FETCH.
  • Streaming I/O (#417 / #418) — export writes stream to disk; marketplace SHA256 + zip extract avoid dual full-buffer copies.
  • RPC / SDUI bounds (#419 / #420) — NDJSON line size caps; virtualized SduiTreeBuilder.
  • Hot-path yielding (#421 / #422) — result cell string conversion and MySQL table browse yield to the UI isolate.
  • Editor / Redis / sandbox / storage (#424–#428) — syntax-highlight threshold, Redis TYPE/TTL pipeline, bounded stderr, SQL history index/prune, incremental theme mtime scan.
  • VirtualResultGrid (#423) — 2D column virtualization for wide result sets.

Fixed

  • UI reliability (#445 / #446–#457) — Escape on showAppDialog; DDL overlay always pops; stats/table loading clears on early exit; tree error + Retry; empty table state; scrollable toolbars; SQL open/save toasts; title-bar scale; Redis/Mongo empty banners; mounted guards; ResultsTab invariants.
  • Correctness follow-ups (#463 / #464–#468) — injectSqlLimit skips string/dollar quotes; delete partial export files on failure; PG tree clears stale children on error; theme watcher queues in-flight refresh; Redis keys error banner clears on success.

Downloads

Portable (zip — run from folder, no installer)

  • Linux: Querya-Desktop-0.4.11-b-linux.zip
  • Windows: Querya-Desktop-0.4.11-b-windows.zip
  • macOS: Querya-Desktop-0.4.11-b-macos.zip (signed, notarized and stapled .app when Apple Developer secrets are configured; otherwise unsigned)

Optional USB-style profile: set QUERYA_PORTABLE=1 or create a QueryaData/ folder next to the binary (see docs/packaging.md).

Installable

  • Linux AppImage: Querya-Desktop-0.4.11-b-linux.AppImage (chmod +x then run)
  • Linux .deb (Debian/Ubuntu): Querya-Desktop-0.4.11-b-linux.deb — sudo apt install ./Querya-Desktop-0.4.11-b-linux.deb
  • Linux .rpm (Fedora/RHEL): Querya-Desktop-0.4.11-b-linux.rpm — sudo dnf install ./Querya-Desktop-0.4.11-b-linux.rpm
  • Linux Flatpak: Querya-Desktop-0.4.11-b-linux.flatpak — flatpak install --user ./Querya-Desktop-0.4.11-b-linux.flatpak
  • Windows setup: Querya-Desktop-0.4.11-b-windows-setup.exe (Inno Setup)

Arch (AUR): PKGBUILD in packaging/linux/aur/ (community-maintained).

Verify checksums: SHA256SUMS.txt

Build info

  • pubspec: 0.4.11-b
  • Commit: 32c263a
Assets 11
Loading