v0.4.1

SLPM 0.4.1

A documentation-only release: the architecture docs now define the standard shape
every release's notes follow, and the notes of all published releases were
rewritten to that shape. Nothing in the app changed.

What's new

Standard release notes

• ARCHITECTURE.md (and its Persian twin) gained a "Release notes" section that
  fixes the sections, their order, and the rules each release's notes obey — from
  the mandatory Files table and Upgrading steps to the rule that security-relevant
  changes get their own section and that a claim about tested distributions
  mirrors what CI actually ran.
• This release exists to make that document true from its first published release
  onward: every note on the Releases page now follows the format it describes.

Upgrading

Nothing functional changed — your 0.4.0 AppImage behaves identically to this one.
If you prefer staying current anyway, the usual sequence works:

kill "$(cat ~/.cache/slpm/server.pid)"
sha256sum --ignore-missing -c SHA256SUMS.txt
chmod +x SLPM-Desktop_0.4.1-x86_64.AppImage
./SLPM-Desktop_0.4.1-x86_64.AppImage

Files

File	What it is
SLPM_0.4.1-x86_64.AppImage	Dashboard, opened in your browser (bundled Python)
SLPM-Desktop_0.4.1-x86_64.AppImage	Dashboard in a native desktop window (host python3 + WebKitGTK)
SHA256SUMS.txt	SHA-256 of both images

Testing

selftest.py is green: 372 checks, unchanged — the release touches documentation
only, so no coverage was added or removed.

Full changelog: v0.4.0...v0.4.1

v0.4.0

SLPM 0.4.0

Install by name no longer requires knowing the exact name: the Install-a-package
box in Advanced Mode now searches all three managers as you type.

What's new

Repository search

• The apt repositories, the Snap store and the Flatpak remotes are searched as you
  type, whichever manager is selected. Matches appear as suggestions under the
  input with a short description each.
• Picking a suggestion fills in the exact name to install — for Flatpak, the app
  id, with the human-readable name shown next to it. Typing "visual studio" finds
  the snap; typing "gimp" finds org.gimp.GIMP.
• The searches are read-only queries against the same repositories the installs
  pull from, and they stay Advanced Mode only, like the install they feed. A
  manager that is not installed answers an empty list rather than an error. A
  Persian query works where the store supports one.

Security notes

A search query is free text, but it is checked before any command is built: a term
starting with a dash — which the underlying tools would read as an option (an -o
would reach apt-cache as one) — is refused at the endpoint on every manager's
route, and the length is capped at 100 characters. The same check now guards the
apt search that existed before.

Fixed

• The suggestion buttons and the dialog choice buttons took their text color from
  the browser's default (black) instead of the theme, which made them unreadable in
  the dark theme. They now follow the theme like every other control.

Upgrading

Stop the running server, verify the new file against the published checksums, swap
and run:

kill "$(cat ~/.cache/slpm/server.pid)"
sha256sum --ignore-missing -c SHA256SUMS.txt
chmod +x SLPM-Desktop_0.4.0-x86_64.AppImage
./SLPM-Desktop_0.4.0-x86_64.AppImage

Your settings and installed software under ~/.cache/slpm are preserved. The
in-app version pill offers the same commands for the image you are actually
running.

Files

File	What it is
SLPM_0.4.0-x86_64.AppImage	Dashboard, opened in your browser (bundled Python)
SLPM-Desktop_0.4.0-x86_64.AppImage	Dashboard in a native desktop window (host python3 + WebKitGTK)
SHA256SUMS.txt	SHA-256 of both images

Testing

selftest.py is green: 372 checks, including new ones for the search term
validator, the tool-output parsers, and the endpoints' Advanced Mode and
malformed-query refusals.

Full changelog: v0.3.1...v0.4.0

v0.3.1

SLPM 0.3.1

I read the whole codebase line by line and wrote down everything that looked wrong
before touching a thing. This release is that list, fixed. Nothing here changes
what SLPM looks like; it changes what happens when something goes wrong, which is
where most of the bugs were hiding.

Security notes

The downloader could be bounced to your own machine. It checked the URL you
gave it against the list of blocked addresses, then followed redirects without
checking again — so a public link could bounce it to 127.0.0.1 or to a router on
your LAN, and whatever came back landed in your Downloads folder. Every hop is
checked now.

Fixed

Privileged commands.

• When pkexec timed out, SLPM retried the same command through sudo -n while
  the original was still running — two package transactions at once, on a box that
  only allows one. That's gone.
• A helper that accepted a command and then lost the reply now reports the outcome
  as unknown instead of letting you watch it run twice.
• LANG/LC_ALL are forced for child processes; on a Persian desktop the English
  error matching had stopped working, so failures came back as raw apt output.

Smaller wrongness.

• Unknown package managers answer 400 like their siblings instead of 200 with a
  false.
• A version string from the browser is checked before it reaches
  apt-get install name=version.
• autoremove finally shows up in the operations log.
• A string "false" can no longer switch a startup entry on.
• AppImage icons are found when they live under usr/share/icons, which is where
  most of them live.
• Flatpak installs go to the user installation, where the uninstaller can actually
  find them.

Paper cuts.

• The "resume" path can no longer write two downloads into the same file, and a
  download job that hits an exception says it failed instead of pretending to run
  forever.
• A reply that arrives after you closed a dialog no longer lands in the next one.
• Flipping between Simple and Advanced a few times quickly no longer paints the
  wrong list.
• The updates page tells you when the fetch failed instead of going blank.
• The version check doesn't reopen itself after you dismiss it.
• On a dark desktop, the theme button sits in the correct state on first load
  instead of lying until you click it.

Upgrading

Swap the old AppImage for the new one. Nothing else on your system was touched:

kill "$(cat ~/.cache/slpm/server.pid)"
sha256sum --ignore-missing -c SHA256SUMS.txt
chmod +x SLPM-Desktop_0.3.1-x86_64.AppImage
./SLPM-Desktop_0.3.1-x86_64.AppImage

Files

File	What it is
SLPM_0.3.1-x86_64.AppImage	Dashboard, opened in your browser (bundled Python)
SLPM-Desktop_0.3.1-x86_64.AppImage	Dashboard in a native desktop window (host python3 + WebKitGTK)
SHA256SUMS.txt	SHA-256 of both images

Testing

selftest.py is green: 352 checks, including a new one that fails the build if the
version drifts between the metainfo files, both READMEs, the website and the
release workflow.

Full changelog: v0.3.0...v0.3.1

v0.3.0

SLPM 0.3.0

This release teaches SLPM to answer the question it manages for everything else on
your computer: is there a newer version of SLPM itself, and how do I get it?

What's new

In-app version check

• The top bar now carries a version pill. Click it and SLPM compares the running
  copy with the newest published release on GitHub.
• When a newer release exists, the dialog hands you two ready terminal commands:
  one to download the AppImage that matches what you are actually running — the
  browser dashboard or the desktop window — together with the release's published
  SHA256SUMS.txt, verified with sha256sum --ignore-missing -c, and one to make
  the file executable and run it.
• The commands follow your variant. Detected server-side from $APPIMAGE, so
  the desktop window suggests the desktop image and the browser dashboard suggests
  the web one. Run from source, SLPM cannot know — it lists both command pairs and
  asks which one you use.
• Nothing happens behind your back. The check is read-only, runs only when you
  click, and never downloads or replaces anything itself. When the release server
  is unreachable or rate-limited, you get a sentence explaining that, not a generic
  error.

Release checksums

Every release from now on ships SHA256SUMS.txt with the SHA-256 of both AppImages.
Verify a download before running it:

sha256sum --ignore-missing -c SHA256SUMS.txt

The in-app check's download command does this for you.

Persian typography

Vazirmatn is now part of the font stack, so Persian text renders with a proper
Persian face (previously it fell through to Noto Sans Arabic). Latin text keeps the
familiar system faces. The documentation screenshots were retaken — the old Updates
shots had caught the page mid-load.

Upgrading

Click the version pill in 0.2.x, or download an image below, replace your old
AppImage file and run it. Stop the local server first:

kill "$(cat ~/.cache/slpm/server.pid)"

Your settings and history under ~/.cache/slpm are preserved.

Files

File	What it is
SLPM_0.3.0-x86_64.AppImage	Dashboard, opened in your browser (bundled Python)
SLPM-Desktop_0.3.0-x86_64.AppImage	Dashboard in a native desktop window (host python3 + WebKitGTK)
SHA256SUMS.txt	SHA-256 of both images

Testing

selftest.py is green in CI (Python 3.12 and 3.14).

Full changelog: v0.2.0...v0.3.0

v0.2.0

SLPM 0.2.0

The dashboard is now also available as a native desktop window, shipped as a second
AppImage alongside the browser one.

What's new

Two AppImages, one dashboard

• SLPM-Desktop hosts the same interface in a real application window (pywebview on
  the system's WebKitGTK) — menu icon, taskbar presence, no browser chrome. The
  language/theme switch inside the app keeps working, and your language is
  remembered.
• The desktop window paints with the system's WebKitGTK and runs on the system's
  Python. Where those are missing, the same image opens the dashboard in the browser
  instead — it never loses functionality.
• Both images detect an already-running SLPM server and reuse it, so they can run
  side by side. Closing the desktop window ends the server it started; a
  dashboard-launched server keeps running until stopped.

Under the hood

• The UI logic was extracted into a core service layer (slpm/core.py): the
  exclusive install/removal job, the Simple-Mode ownership gate, the operations log
  and the environment summary now live in one shared core that every interface —
  web, desktop window, and a future CLI — calls identically.

Fixed

• The filter dropdown rendered as a big white button in the desktop window under
  dark theme. Native select controls ignore the CSS palette on WebKitGTK; they are
  now drawn from the theme with a custom chevron.

Upgrading

Stop SLPM, then run the newer file instead of the old one:

kill "$(cat ~/.cache/slpm/server.pid)"
chmod +x SLPM-Desktop_0.2.0-x86_64.AppImage
./SLPM-Desktop_0.2.0-x86_64.AppImage

Your data under ~/.cache/slpm is kept.

Files

Both images are built for x86_64.

File	What it is
SLPM_0.2.0-x86_64.AppImage	Dashboard, opened in your browser (bundled Python)
SLPM-Desktop_0.2.0-x86_64.AppImage	Dashboard in a native desktop window (host python3 + WebKitGTK)

Testing

• The selftest suite passes on clean machines (CI, Python 3.12/3.14) and against a
  real desktop system.
• The web image is smoke-tested in clean containers (ubuntu:22.04, debian:12,
  ubuntu:24.04, ubuntu:26.04): bundled-interpreter identity, endpoint answers,
  DNS-rebinding guard, pages rendering, and a real HTTPS download through SLPM's
  own API.
• The desktop image is smoke-tested headless (ubuntu:24.04, ubuntu:26.04,
  debian:13) after resolving python3, python3-gi and gir1.2-webkit2-4.1
  like a target machine, and was verified on a real Ubuntu 26.04 Wayland desktop:
  native window, Persian RTL rendering, server lifecycle.

Full changelog: v0.1.0...v0.2.0

v0.1.0

SLPM 0.1.0

The first tagged release: a simple local web app for installing, viewing, launching
and removing Linux software without using package-manager commands directly.

What's new

The dashboard

• Simple and Advanced modes: Simple lists only the apps SLPM can identify as
  user-installed; Advanced shows the installed dpkg/apt package database. The split
  is evidence-based — SLPM reads the package managers' own records (the dpkg log,
  the snap seed file, Flatpak deployment timestamps) instead of guessing from file
  locations.
• A Startup Apps tab for viewing, adding and turning off startup entries, and a
  Shortcuts tab for managing the applications menu — launch, inspect, delete your
  own, or hide pre-installed ones without touching system files.
• An Updates tab (both modes) listing what apt, Flatpak and Snap each have
  available, with per-item or whole-manager updates and a running-snap warning.
• Install by name (Advanced Mode only): search the apt repositories as you type, or
  install by exact name.
• Local file installation: .deb, .snap, AppImage, .flatpakref, several archive
  formats, and .run/.sh files that are registered without being executed — from
  a local file or a download link.
• Background downloads with pause, continue and stop, a live progress bar, and
  automatic installation after completion.
• Automatic detection of apt, Flatpak and Snap; English and Persian interface with
  light and dark themes; confirmations and safety warnings for removal, with
  administrator access requested through pkexec or sudo only at the moment an
  operation needs it.

Upgrading

Nothing to upgrade from — this is the first tagged release. Download the AppImage,
make it executable and run it:

chmod +x SLPM_0.1.0-x86_64.AppImage
./SLPM_0.1.0-x86_64.AppImage

Files

File	What it is
SLPM_0.1.0-x86_64.AppImage	The dashboard, opened in your browser (bundled Python)

Testing

selftest.py is green in CI (Python 3.12 and 3.14). The web image is smoke-tested
in clean containers — ubuntu:22.04, debian:12, ubuntu:24.04 — with no system
Python involved.