Pullwatch 0.7.0

Thank you again, Ruben

Once more nearly everything in this release was built by Ruben Talstra (@rubentalstra) in Vernum-Projecten/pullwatch: CI checks and the merge queue on every pull request, redesigned notifications, a cleaner repository page, where each vulnerability comes from, what blocks a package update, and a thorough tidy-up of the code underneath. Thank you, Ruben! 🙏

Added

• Dependencies and the repository page show whether each package can be updated: a Status
  column with Up to date, Update within range (patch or minor), Major update or Blocked, and
  groups for Can update now, Needs a manifest change and Blocked. The repository page shows the
  newest version you can use now next to the newest version, and for a blocked package what holds
  it back and what to update first, such as "Held at 18.3.1 by react-dom, which asks for ^18.3.1.
  Update react-dom to 19.1.0 first." or "6.0.0 needs Node ^18.0.0 || >=20.0.0; the repository
  uses Node 16." (Vernum-Projecten#85)
• The fix line of a vulnerability says whether the fix is within range, needs a manifest change,
  or is blocked, and what to update first. Copied repository text and notifications say the same (Vernum-Projecten#85).
• The sidebar badge of Dependencies counts only updates you can take now and security fixes (Vernum-Projecten#85).
• New setting in Settings, General: new-version notifications only for updates you can take now
  (on by default) (Vernum-Projecten#85).
• Watch single GitLab projects you add yourself. Under "Other
  Repositories" in a GitLab account's repository list, or with "Watch a
  Repository…", type group/subgroup/project or paste a link from
  gitlab.com or your own GitLab server. A public project your token can't
  read is read without signing in, when the server allows that. Each added
  project costs one request for its merge requests per poll (Vernum-Projecten#94).
• Every vulnerability shows where it comes from: the database that published it (RustSec,
  GitHub, PyPA, Go, NVD and more) next to its id, and an info button with all its ids as links
  (GHSA, CVE, RUSTSEC, GO, PYSEC), related ids, the references with the fix first, and the
  published and modified dates. The severity now comes from the best source: the CVSS 3.1 or
  4.0 vector in the advisory (Pullwatch computes the score), then the database's own rating,
  then GitHub's advisory, and the row says which one it was. Withdrawn advisories are left out
  and counted separately. The copied text and notifications read "RUSTSEC-2023-0071 (RustSec),
  also GHSA-… and CVE-…" (Vernum-Projecten#96).
• Rows and buttons in the menu-bar panel light up under the pointer, like
  macOS's own menu-bar panels, and the highlight fades in smoothly (Vernum-Projecten#106).
• Settings, Sources also lists the CI checks of pull requests, with a switch.
  When it is off, Pullwatch asks no server for the checks, hides the checks it
  fetched before and sends no notification about failed checks (Vernum-Projecten#114).
• Each pull request shows its checks (CI) like GitHub's list: an icon in the
  colour of the state (a green check, a red cross, an amber dot while checks
  run) and how many passed out of all of them, such as 4/8, in the PR list,
  the menu and a repository's pull requests. The tooltip and VoiceOver say it
  in words. Works for GitHub, Azure DevOps and GitLab; on GitHub the app's
  Checks and Commit statuses permissions (read) are needed, otherwise the
  repository page says Needs permission (Vernum-Projecten#114).
• An optional notification when the checks of one of your own open pull
  requests fail, off by default, under Settings, Notifications (Vernum-Projecten#114).
• Pull requests waiting to merge by themselves show as Queued, with GitHub's merge
  queue icon in GitHub's amber, in the pull request list, the menu bar, a repository's
  pull requests and the statistics (counted as open). On GitHub that is a pull request
  in the merge queue, with its position in the tooltip; on GitLab a merge request set to
  auto-merge or in a merge train; on Azure DevOps a pull request with auto-complete set.
  Entering the queue sends no notification (Vernum-Projecten#124).

Changed

• Every PR author has a profile picture in the list, also without
  co-authors, as tags already did; bots show their own picture (Vernum-Projecten#49).
• The repository page is cleaner: tabs for Overview, Check, Packages and
  Security, and on Check and Packages counts at the top (vulnerabilities,
  outdated runtimes, packages you can update, blocked) that filter the tab.
  Runtimes and frameworks sit in a compact grid; vulnerabilities, packages and
  the service's own security findings are sortable tables with search and
  filters, one row per advisory with its installs underneath. Selecting a row
  opens an inspector with the summary, the severity and where it comes from,
  every id and link, the fix, the affected installs and buttons to open or
  copy the advisory. Space opens and closes the inspector (Vernum-Projecten#97).
• Dependencies fits the smallest window without scrolling sideways, and its
  status column says "Up to Date" instead of "Current" (Vernum-Projecten#97).
• Notifications are redesigned. The title says what happened ("New Pull Request", "Pull Request Merged", "New Release v1.2.0", "Critical Vulnerability"), the subtitle names the repository, and the body gives the title with its author and co-authors. macOS stacks them per repository, and above 20 items in one poll each repository gets one summary.
  Notifications have buttons: Mark as Read, Open Repository Page and Mute Repository (with Undo in the menu), and Show in Pullwatch and Copy Advisory ID on a vulnerability. A GitHub author's avatar is attached.
  New pull requests, releases and vulnerabilities come with a banner; tags, merged pull requests and new versions arrive quietly in Notification Center. Reading an item in Pullwatch removes its notification.
  The new Settings > Notifications pane has a switch per kind with a preview, quiet hours, and options for the Dock badge and the unread dot in the menu bar. The notification switches under General moved there (Vernum-Projecten#101).

Fixed

• Statistics use GitHub's pull request colours and show all four states: opened
  (green), draft (gray), merged (purple, "completed" for Azure DevOps) and closed
  without merging (red), as stacked bars per period and as tiles. Hovering an
  author or repository shows how its pull requests are split over those states (Vernum-Projecten#105).
• An account signed in with GitHub no longer has to sign in again when a check is
  stopped while its GitHub token is being renewed, or when two checks renew it at the
  same time (Vernum-Projecten#117).
• When gh, az, glab or a server does not answer in time, the account
  status now says so in your language ("gh did not answer in time") instead of
  a Dutch timeout text. A few other error details (a missing HTTP response, an
  incomplete answer from GitHub or OSV) are translated as well (Vernum-Projecten#122).

Pullwatch 0.6.0

Thank you, Ruben

This release would not exist in this form without Ruben Talstra (@rubentalstra). He created the fork Vernum-Projecten/pullwatch, where nearly everything in 0.6.0 was built, and his input and ideas shaped where Pullwatch is going:

• More places to follow: GitLab (gitlab.com and your own server), GitHub Enterprise Server and GHE.com, and single repositories you add yourself.
• Sign in with GitHub through the Pullwatch GitHub App, a welcome window that walks you through your first account, and profile pictures and co-authors in the pull request list.
• A much deeper version check: every install of every package with where it comes from, more lockfiles (yarn, pnpm, NuGet, Gemfile), version ranges per ecosystem, what blocks an update, and GitHub's advisories, code scanning and secret scanning.
• A new main window with navigation, search, tables, mark as read or unread, and GitHub's icons for pull requests.
• Updates inside the app with Sparkle, a signed and notarised release lane, CI on every pull request, and a proper install window in the disk image.

Thank you, Ruben, for the time, the care and the many good ideas. 🙏

Added

• Sources in Settings: every source Pullwatch takes vulnerability and
  version information from (OSV.dev, the GitHub Advisory Database, GitHub
  security, Azure DevOps Advanced Security, the package registries,
  endoflife.date and swift.org), with what it provides, the address it
  calls and a switch to turn it off, plus every other connection Pullwatch
  makes (your accounts' servers, Sign in with GitHub, profile pictures and
  the update check). Copy overview puts the list on the clipboard, to
  share with whoever asks where the data comes from. A source that is off
  is never called, and wherever that leaves something unchecked Pullwatch
  says so ("Not checked: source OSV.dev is off") instead of "no
  vulnerabilities" or "up to date".
• Copy a section for an AI agent. Every heading on a repository's page
  has a copy button that puts that section on the clipboard as an English
  Markdown brief: packages with their versions, files, ranges and what
  blocks an update; vulnerabilities with their ids and fixed versions;
  security alerts; pull requests; each with a task line an agent can act on.
• Language in Settings, General: follow macOS (the default) or choose
  Nederlands, English, Deutsch or Français, with a button to restart
  Pullwatch in that language.
• Welcome window on first launch. It walks through adding an account
  and asks for permission to send notifications by itself. Its headings are
  announced by VoiceOver and its text wraps or scrolls at larger sizes (Vernum-Projecten#5).
• An install window in the disk image: the app and a link to
  Applications on a background with an arrow (Vernum-Projecten#7).
• CI and a release workflow. Every pull request runs the package tests,
  the app's unit and UI tests and an unsigned release build with the disk
  image. A tag vX.Y.Z builds, signs, notarises and packages the release
  and attaches it to a draft GitHub release (Vernum-Projecten#8).
• Updates inside the app with Sparkle. When a new version is out, the
  menu and the notification offer Install: Pullwatch shows the release
  notes, downloads the update, checks its signatures, installs it and
  restarts. Settings, General, Updates adds Install updates
  automatically (download in the background, install when you quit) and
  Include test versions (pre-releases). An update is only offered on a
  macOS version it runs on (Vernum-Projecten#9).
• GitLab accounts, on gitlab.com or your own server (https only): Pullwatch follows the
  merge requests, tags and releases of the groups (with their subgroups) and users you
  choose, shows who worked on a merge request, and runs the version and vulnerability check
  on GitLab repositories. Sign in with a personal access token with the read_api scope or
  with the GitLab CLI (glab auth login). Add one in the welcome window or under
  Settings, Accounts (Vernum-Projecten#10).
• GitHub Enterprise accounts, on GitHub Enterprise Server or your enterprise's subdomain on
  GHE.com (https only): choose GitHub Enterprise on the GitHub card in the welcome window or
  in the add menu under Settings, Accounts, and enter your server. Pullwatch follows pull
  requests, tags and releases there, links to that server and shows its host on the account
  card. Sign in with a personal access token made on the server or with the GitHub CLI
  (gh auth login --hostname). What a server lacks, such as a repository's own advisories
  on GitHub Enterprise Server, shows as not available instead of an error (Vernum-Projecten#11).
• Sign in with GitHub through the Pullwatch GitHub App (device flow):
  the code goes on the clipboard, the app waits for the approval and the
  installation, and lists the accounts and organisations where it is
  installed. Debug builds use the test app "TEST Pullwatch" (Vernum-Projecten#18).
• Profile pictures for GitHub accounts (Vernum-Projecten#22).
• Log level in Settings, General, and a button that opens Console (Vernum-Projecten#35).
• Co-authors of a pull request. The PR list shows the author with the
  people who worked on it (commit authors and Co-authored-by: trailers),
  as small avatars and "mona and 2 others"; hover for every name. GitHub
  asks once per new or changed PR in one batched GraphQL request, Azure
  DevOps reads the PR's commits. Statistics can count co-authors too (Vernum-Projecten#49).
• Where each package and vulnerability comes from. The repository page
  lists packages per workspace in Direct, Transitive and Dev groups, with
  every version on its own row and the chain it comes through ("via
  express → body-parser"). A vulnerability shows once per advisory with
  Direct or Via express, Dev only and what to update, and the count counts
  advisories. Dependencies shows each repository's versions per workspace and
  marks repositories that only have a package transitively. New CVE
  notifications and the copied repository text say direct or via which
  package (Vernum-Projecten#58).
• More lockfiles for the package and vulnerability check: yarn.lock
  (classic and Berry), pnpm-lock.yaml (v6 to v9), NuGet
  packages.lock.json and Gemfile.lock, each install with its workspace,
  direct or transitive, runtime, dev or optional, and the chain it comes
  through. Ruby gems get their latest version from rubygems.org (Vernum-Projecten#59).
• Mark as read or unread in the main window. Right-click a PR or tag
  (or press ⇧⌘U, as in Mail), mark everything in the list as read with the
  toolbar button or ⌘K, and see unread items by their blue dot. The menu's
  rows have Mark as Read and Mark as Unread too (Vernum-Projecten#63).
• GitHub's advisories and security alerts. Each vulnerability shows its
  GHSA id next to the CVE, GitHub's severity with the CVSS score and vector,
  the CWE names and a link to github.com/advisories, on the repository page,
  in the copied text and in notifications; each advisory is fetched once.
  The repository page gets a security section with the repository's own
  published advisories, open code scanning alerts and the number of open
  secrets on GitHub, or the Advanced Security alerts on Azure DevOps. Open
  critical and high alerts count in the Repos findings and health, with an
  optional notification (Settings, General). A kind the app may not read
  yet shows Needs permission with a link (Vernum-Projecten#73).
• The version check keeps the range each manifest asks for next to the installed version (npm, yarn
  and pnpm, Composer, PyPI and Poetry, Cargo, NuGet, RubyGems, Go modules and Swift packages), and
  works out per install whether the newest version fits that range, so only the lockfile changes,
  or needs a manifest change, and whether the step is a patch, minor or major update (Vernum-Projecten#83).
• The version check now reads what each package version asks for from its registry (npm,
  Packagist, crates.io, NuGet, RubyGems, PyPI and the Go proxy) and works out what holds an
  update back: a parent package whose range pins it, a peer dependency, or a runtime (Node, PHP,
  Python, Rust, .NET, Ruby, Go) that is older than the new version needs. It also finds the
  newest version you can use right now, and the lowest parent version that lets a fix through.
  Vulnerability fixes use the same rules. Details per version are kept between checks, so a
  check asks the registries for little more than before (Vernum-Projecten#84).
• Watch single repositories you add yourself. Under "Other
  Repositories" in an account's repository list, or with "Watch a
  Repository…" in the main window (Go menu and the Repos toolbar), type
  owner/repo or paste a github.com or dev.azure.com link. Pullwatch checks
  it first and says in plain words when it can't find or read it. On GitHub
  this works for public repositories of other organisations too, without
  the Pullwatch app installed there; when your account can't read one,
  Pullwatch reads it without signing in and says so (Vernum-Projecten#89).

Changed

• A new app icon in Icon Composer format (Vernum-Projecten#4).
• scripts/release/release.sh notarises and staples the app before
  packaging it, so the app in the zip carries its own ticket too (Vernum-Projecten#8).
• The project is a committed Xcode project with settings in .xcconfig
  files and a folder per area (Vernum-Projecten#12).
• Account names follow the organisation (Vernum-Projecten#21).
• Progress has one place: a bar at the bottom of the main window for the
  first s...

Pullwatch 0.5.0

• Repositories: the repository check becomes Repo's, a list per project, worst first: red for known CVEs or an end-of-life runtime, orange for a runtime that is behind or packages with a new version, green when current. Each repository has its own page with its PRs, the check, packages with a new version and its activity, plus buttons to open it in the browser, check it again and follow it (PR's, Tags, Completed, each with its own notification bell) without going to Settings.
• Statistics: PR activity per week, month or year: opened and merged PRs, median time to merge, active authors, and rankings of authors and the busiest repositories. Filter on a project, an author or a repository; bots are hidden by default.
• Shortcuts: ⌘1–⌘5 for the sections, ⌘F search, ⌘R refresh, ⌘[ or Esc back, ⌘O open in the browser. Jump from a repository to its PRs, tags and statistics, from a CVE to its package, from an author to their PRs, and from the menu to a PR's repository.
• Faster: the repository overview is calculated once instead of on every screen update.
• The menu header shows the version number.
• Every full version check now keeps a compact snapshot, for statistics on versions and CVEs in a later release.

Install: open Pullwatch-0.5.0.dmg and drag Pullwatch to Applications. Signed with a Developer ID and notarized. Universal (Apple silicon and Intel), macOS 14+.

Pullwatch 0.4.0

• One main window: PR's, Tags, Repo-controle (the former Versions window), the new Versies section and Instellingen (settings) now share one window with a sidebar. Openen… in the menu opens it; Instellingen… and ⌘, open the settings there.
• Projects in the sidebar: PR's and Tags expand into projects (Azure DevOps) or owners (GitHub), each with its own unread count. Selecting one filters the list and the search.
• Versions per package: see which runtimes and direct dependencies your repositories use, which version is the latest and which repositories are still on an older one. Runtimes are compared within their release cycle, patches included (Go 1.27.3 → 1.27.4); packages against their registry (Go proxy, npm, Packagist, NuGet, PyPI, crates.io). Package names are sent to these registries, also for private repositories.
• Notification for new versions: after the daily check, one notification lists the new versions of anything a repository is behind on. Turn it off under Settings → General.

Install: open Pullwatch-0.4.0.dmg and drag Pullwatch to Applications. Signed with a Developer ID and notarized. Universal (Apple silicon and Intel), macOS 14+.

Pullwatch 0.3.3

• Swift versions: Swift is compared with the releases on swift.org instead of showing as unknown. Swift has no EOL policy, so a version is current or behind, never EOL.

Install: open Pullwatch-0.3.3.dmg and drag Pullwatch to Applications. Signed with a Developer ID and notarized. Universal (Apple silicon and Intel), macOS 14+.

Pullwatch 0.3.2

• Several GitHub CLI accounts: when you're logged in to gh with more than one account, each GitHub account in Pullwatch can now use a fixed one (Settings → Accounts → GitHub account) instead of whichever is active in gh.

Install: open Pullwatch-0.3.2.dmg and drag Pullwatch to Applications. Signed with a Developer ID and notarized. Universal (Apple silicon and Intel), macOS 14+.

Pullwatch 0.3.1

• Update check: Pullwatch now checks GitHub once a day (and at launch) for a newer release. When there is one, you get a notification and a download bar in the menu. Turn it off or check manually under Settings → General.

Install: open Pullwatch-0.3.1.dmg and drag Pullwatch to Applications. Signed with a Developer ID and notarized. Universal (Apple silicon and Intel), macOS 14+.

Updating from 0.3.0 or earlier: quit Pullwatch first, then replace the app. From now on Pullwatch tells you when a new version is out.

Pullwatch 0.3.0

• Languages: Pullwatch is now available in English, Dutch, German and French. It follows the macOS language (English for anything else), or pick one under Settings → General → Language.
• About: the ⓘ button in the menu opens the About panel with version, link and license.

Install: open Pullwatch-0.3.0.dmg and drag Pullwatch to Applications. Signed with a Developer ID and notarized. Universal (Apple silicon and Intel), macOS 14+.

Updating: quit Pullwatch first (menu → Stop / Quit), then replace the app. Settings and history are kept.

Pullwatch 0.2.1

Pullwatch is now signed with a Developer ID and notarized by Apple: it opens without a Gatekeeper warning, no right-click → Open or xattr needed.

Install: open Pullwatch-0.2.1.dmg and drag Pullwatch to Applications. Universal (Apple silicon and Intel), macOS 14+.

Coming from 0.2.0: quit Pullwatch first (menu → Stop), then replace the app. Your settings and history are kept. Because the signature changed, macOS may ask once more for Keychain access for PAT accounts; choose "Always Allow".

Pullwatch 0.2.0

First public release.

• Notifications for new pull requests, tags and merged (completed) PRs in GitHub and Azure DevOps; per repository you choose what to follow and which kinds notify.
• Searchable history of PRs and tags.
• Versions window: languages, runtimes, frameworks and Docker images per repository compared with endoflife.date, plus known vulnerabilities via OSV.dev, for the default branch and the latest tag. Runs daily, notifies on new CVEs.
• Shows in the Dock while a window is open.

Install: open Pullwatch-0.2.0.dmg and drag Pullwatch to Applications. The app is ad-hoc signed and not notarized: right-click → Open on first launch, or xattr -dr com.apple.quarantine /Applications/Pullwatch.app. Universal (Apple silicon and Intel), macOS 14+.