Dendro 2.12.0 — Direct repository configuration support and AppImage runtime repair

Direct repository configuration support

Dendro can now add a third-party repository from a direct HTTPS .repo
configuration URL on a native Fedora RPM installation.

• The configuration is downloaded as the desktop user, not as root.
• Before authorization, Dendro bounds the response, requires UTF-8 text, and
  validates the direct HTTPS address.
• The fixed Polkit helper independently validates the repository definition,
  permits only a narrow DNF5 repository-option allowlist, requires package
  signature verification, rejects duplicate repository IDs, and creates a new
  root-owned file atomically without overwriting an existing file.
• Dendro does not run dnf, dnf5, a shell, or an arbitrary privileged command
  for repository addition.
• A direct COPR repository-file URL is supported. A COPR owner/project value,
  local file path, and generic command are intentionally not accepted.

Repository-file addition and removal require the helper installed by the Fedora
RPM. They remain unavailable from the Flatpak, AppImage, source checkout, and
wheel installation. Flatpak continues to reject host-helper launch.

AppImage startup repair

The AppImage build now bundles the required native Qt XCB/XKB runtime library
closure and the corresponding package copyright notices. Release CI also runs
an offline Xvfb startup smoke test that verifies a real application window is
mapped.

Upgrade notes

• On Fedora RPM installations, update Dendro normally through the configured
  repository after the COPR build for this tag succeeds.
• To add a repository, open System Software Repositories and paste the
  direct HTTPS URL to the provider's .repo file.
• Adding the same source again does not overwrite the existing generated file.
  Remove the existing test or obsolete repository before adding a replacement.
• Confirm the normal Polkit prompt only after reviewing the repository provider
  and URL.

Validation

The GitHub release workflow builds the Python distributions and AppImage, then
runs the offline graphical AppImage smoke test. The subsequent COPR RPM build
runs the RPM test suite plus AppStream and desktop-file validation from the
spec file. Treat both pipelines as release gates before announcing the update.

Dendro 2.11.0 — DNF5 daemon transactions and repository hardening

Summary

Dendro 2.11.0 moves package-changing operations to Fedora's DNF5 system daemon
and documents the runtime contract required for updates and repository
management.

Changed

• Package install, removal, and upgrade requests are resolved through
  dnf5daemon-server on org.rpm.dnf.v0.
• Dendro displays the daemon-resolved transaction plan before authorization and
  executes that retained plan after confirmation.
• DNF5 owns RPM transaction locking and requests Polkit authorization. Dendro
  no longer uses a generic privileged dnf command runner for package
  transactions.
• Update checks, repository state changes, and cache cleanup use the DNF5
  daemon API.
• Repository file deletion remains a separate, constrained operation on RPM
  installations because the DNF5 daemon does not expose a repository-file
  deletion API.

Repository safety

• Repository origin classification now parses repository baseurl values and
  compares normalized hostnames using exact or domain-boundary matches.
• A trusted domain appearing in a URL path, query string, user-info field, or
  lookalike hostname is not classified as a Fedora, COPR, or RPM Fusion origin.
• Malformed repository URLs are handled as untrusted origins.

Packaging and runtime

• The Fedora RPM requires dnf5daemon-server,
  dnf5daemon-server-polkit, Polkit, and the required PyQt6 and RPM bindings.
• Source checkouts and AppImages remain unprivileged clients of the Fedora host
  DNF5 daemon; they do not bundle a package-management service.
• The Flatpak is limited to the typed org.rpm.dnf.v0 system-bus service. It
  does not receive a generic host-command or host-filesystem escape.

Important deployment note

Dendro package-management features require a Fedora system with a usable system
D-Bus, dnf5daemon-server, and a Polkit authentication agent.

Desktop-only containers such as lscr.io/linuxserver/webtop:fedora-kde are not
supported package-management targets unless they deliberately provide that full
system service contract. Do not mount the host D-Bus socket, RPM database, or
host filesystem into a desktop container to work around a missing daemon.

Upgrade

Fedora RPM users can upgrade with:

sudo dnf upgrade --refresh dendro

**Full Changelog**: https://github.com/xyasharx/Dendro/compare/v2.10.1...v2.11.0

v2.10.1 — DNF5 Repo Overrides Ingestion, Live Network Diagnostics & UI Alignment

Dendro 2.10.1 — DNF5 Repo Overrides Ingestion, Live Network Diagnostics & UI Alignment

Highlights

• DNF5 Drop-In Repository Overrides Ingestion:
  In modern DNF5 (Fedora 41+), running config-manager setopt <repo>.enabled=0 writes overrides to /etc/dnf/repos.override.d/99-config_manager.repo rather than modifying the base .repo file in /etc/yum.repos.d/. Dendro now scans and ingests DNF5 override directories, ensuring repository disable states persist reliably across restarts.

• Sequential Polkit Command Queueing:
  Toggling multiple repository checkboxes in rapid succession now queues commands in PolkitTransactionRunner, preventing subsequent actions from being silently dropped while an authorization prompt is active.

• Live Network Diagnostics & Error Surfacing:
  Fixed an issue where the footer status bar remained frozen on "Connecting to remote mirror servers..." if a network issue occurred. The mirror checker now monitors stderr for connection timeouts, unreachable servers, and DNS resolution failures, surfacing clear error messages (e.g. "Mirror Check Failed: Cannot resolve mirror host").

• Explicit "System Up to Date" State:
  When a mirror check succeeds and finds 0 pending updates, the status bar now updates to "Your system is completely up to date. (All remote mirrors refreshed)" instead of leaving the initial connection message visible.

• COPR Onboarding UI Harmonization:
  Aligned the "Enable COPR" button and the repository search filter input with matching 26px content heights, 6px corner radii, and clean card framing (#CoprBox), eliminating the height mismatch where the button was taller than the input field.

• Pipe Stream Contention Fix:
  Separated stdout and stderr reader streams in SystemUpdatesCheckWorker, avoiding pipe contention during live repository checks.

Full Changelog: v2.10.0...v2.10.1

v2.10.0 — Preferences Dialog, Live Mirror Telemetry, Two-Phase Progress & Search Engine

Dendro 2.10.0 — Preferences Dialog, Live Mirror Telemetry, Two-Phase Progress & Search Engine

Highlights

• Dedicated Preferences & About Dialog (Ctrl + ,):
  Introduced a dedicated settings window accessible from the toolbar cluster or via the standard Ctrl + , shortcut. Users can manage packaging preferences, view runtime engine bindings, and access project licensing and repository information.

• RPM Epoch (%{epoch}:%{evr}) on Demand (#40):
  Added an option in Preferences to display package versions with their explicit epoch prefix (e.g. 0:1.10.3-1.fc45). Toggling this setting immediately updates the Version / Upgrade Path column across the entire tree in real time without reloading the database.

• Real-Time Filter Syntax Validation & Autocompletion (#40):

  • Color-Coded Validation: Typing valid filters (like arch:noarch or status:available) highlights the search bar in green, while invalid filter keys or values (like arc:noar) highlight in purple with informative tooltips detailing the error.
  • Native Autocompletion: Attached a native QCompleter to the search input, allowing quick keyboard autocompletion for filter keys and canonical options (arch:x86_64, status:available, type:gui).

• Unrestricted Global Search (#40):
  Typing in the search bar now automatically searches across all installed packages on the system, eliminating the restriction where queries were trapped inside whatever sidebar category was currently highlighted. Dedicated maintenance queues (queued, updates_available, orphans) remain scoped for review.

• DNF5 EVR Target Version Fix:
  Resolved a schema mismatch with upstream dnf5 check-upgrade --json (which provides evr and repository rather than separate version/release keys). Upgrade target versions now display reliably in Column 2 (1.10.3-1.fc41 -> 1.10.4-1.fc41), on the Inspector action button, and in context menus without missing tags or trailing hyphens.

• Two-Phase Transaction Progress Engine:
  Fixed an issue where the transaction progress bar stayed at 0% and jumped directly to 100% at the end. The engine now operates in two distinct phases:

  • Download Phase (0% to 30%): Smoothly tracks incoming package downloads.
  • Transaction Phase (30% to 100%): Tracks package verification, preparation, upgrades, and cleanup ([1/4] $\to$ [2/4] $\to$ [3/4] $\to$ [4/4]), incrementing the bar gradually in real time alongside terminal output.
  • Merged standard error and standard output channels to ensure interactive DNF progress streams are captured.

• Live Mirror Refresh Telemetry:
  Clicking Check Mirrors (--refresh) now streams live download activity directly in the footer status bar, displaying the exact repository name and its configured remote address (metalink, mirrorlist, or baseurl).

• Instant Post-Transaction Cache Eviction:
  Upgraded packages are now immediately evicted from the pending updates cache the moment a transaction finishes with exit code 0, removing them from the "Available Updates" view instantly without requiring a manual click on Reload.

• Dialog Button Styling & Mnemonic Cleanup:
  Properly scoped toolbar button height constraints so that primary action buttons in modal simulation dialogs and execution drawers retain their comfortable padding and rounded corners. Replaced unescaped ampersand mnemonics in button labels (Proceed and Authenticate, Commit and Authenticate).

Acknowledgments

Special thanks to Ricky Tigg (@Ricky-Tigg) for proposing the RPM Epoch display option, search filter syntax validation, and providing thorough usability feedback in #40.

Full Changelog: v2.9.0...v2.10.0

v2.9.0 — Multi-Tier Removal Safety Engine, Responsive Layouts & Search Polish

Dendro 2.9.0 — Multi-Tier Removal Safety Engine, Responsive Layouts & Search Polish

Highlights

• Deterministic Multi-Tier Removal Safety Engine:
  Replaced incomplete safety checks with a five-tier removal risk assessment engine (CRITICAL, HIGH, MEDIUM, LOW, SAFE). Ordinary desktop software (such as kate, firefox, or gimp) is accurately classified as LOW Risk (Standard User Software). Clean NVRA parsing in transaction simulations also eliminates false alarms on harmless subpackages (rpm-build, kernel-headers, bash-completion).

• Responsive Layout & Layout Persistence (#40):

  • F11 Fullscreen: Added an F11 shortcut to toggle fullscreen mode, with intelligent state memory that returns to a maximized window if it was maximized beforehand.
  • Resizable Sidebar: Unlocked the left category sidebar down to a 180px minimum width (previously locked at 290px).
  • State Persistence: Splitter positions and custom column widths now save automatically to QSettings and restore across application restarts.
  • Horizontal Scrollbar Restored: Fixed an issue where the horizontal scrollbar was hidden in CSS, ensuring columns (Size, Summary) are always reachable on smaller screens.
  • Compacted Column Baselines: Reduced default column widths from 745px down to ~565px so the Summary column fits naturally on standard laptop displays.

• Column Visibility Picker (#40):
  Users can now right-click any column header in the central package tree to selectively toggle columns (Status, Version, Size, Summary) on or off.

• Search & Filter Polish:

  • Added support for the status:available (and status:remote) search filter.
  • Multi-word remote repository queries (e.g., gnome shell) now synthesize wildcards (*gnome*shell*) so searches match hyphenated RPM package names properly.
  • File path ownership lookups (rpm -qf) now verify path existence on disk before triggering, preventing erratic jumps while typing paths like /usr/bin/git.

• Toolbar Geometry & Dialog Button Polish:

  • Globally unified all header buttons, status indicators, and the search input to an exact 28px outer height standard.
  • Properly scoped header button height rules so that primary action buttons in modal dialogs (DryRunSimulationDialog) and drawers (TransactionDrawer) retain their comfortable padding and rounded corners.
  • Cleaned up unescaped ampersand mnemonics in button labels (Proceed and Authenticate, Commit and Authenticate).

• Privileged Repository Deletion:
  The repository manager's "Remove Repo" action now permanently deletes third-party .repo configuration files via pkexec rm -f instead of only disabling them.

• Live Inspector Synchronization:
  Toggling package queue states via the Space bar, right-click context menu, or Discard button now immediately synchronizes the Inspector Panel's action button state without requiring deselection.

Acknowledgments

Special thanks to Ricky Tigg (@Ricky-Tigg) for detailed testing, layout observations, and usability suggestions in #40.

Full Changelog: v2.8.3...v2.9.0

v2.8.3 — Architectural Hardening, Singleton Runner Lifecycle & Zero Polling

Dendro 2.8.3 — Architectural Hardening, Singleton Runner Lifecycle & Zero Polling

Summary of Changes

• Zero-Polling Architecture: Removed the residual 500ms polling timer in main.py. The Linux kernel now manages process signals natively with SIG_DFL, ensuring true 0.0% CPU usage while idle.
• Singleton Transaction Runner: Refactored PolkitTransactionRunner from being re-instantiated on demand across multiple UI methods into a persistent, single-instance service on MainWindow. This eliminates redundant signal re-bindings and prevents orphaned QObject memory leaks.
• Event-Queue CLI File Opener: Replaced the arbitrary 300ms magic sleep timeout with an event-driven QTimer.singleShot(0) queue post, opening local .rpm package files immediately once the main window completes its initial display map.
• Diagnostic Timestamp Parity: Added ISO millisecond timestamps ([YYYY-MM-DD HH:MM:SS.mmm]) to the backend startup benchmark logs, matching the initial telemetry banner.
• Static Analysis Compliance: Cleaned up variable scoping in main.py to ensure 100% clean passes under Ruff (F821, F822, F823).

Full Changelog: v2.8.2...v2.8.3

v2.8.2 — Idle CPU Quiescence, UI Metrics & DNF5 Hardening

Dendro 2.8.2 — Idle CPU Quiescence, Vector Theming, UI Metrics & DNF5 Hardening

Summary of Changes

• Idle CPU Quiescence (0.0% CPU): Replaced the 1200ms background polling loop with native in-process colorSchemeChanged and D-Bus FreeDesktop Portal (org.freedesktop.portal.Settings.SettingChanged) signal subscriptions. Dendro now transitions themes instantaneously with zero idle CPU wakeups or subprocess spawns.
• DNF5 Query Format Fix: Appended explicit newlines to dnf5 repoquery --queryformat (%{name}\n), preventing single-line package name concatenation on Fedora 41+ and restoring accurate leaf orphan and user-installed detection.
• UsrMerge Symlink Resolution: Enhanced find_package_owning_file (rpm -qf) to canonicalize symlinked paths (/bin, /sbin, /lib64), ensuring ownership lookups resolve reliably regardless of input format.
• Terminal Log Cursor Anchoring: Anchored the log insertion point strictly to MoveOperation.End in TransactionDrawer, preventing text selection from scrambling real-time streaming Polkit logs.
• Worker Concurrency Hardening: Fixed an UnboundLocalError exception triggered during background reverse dependency query cancellations.
• Hot-Path Regex Precompilation: Precompiled static regular expressions across natural version sorting, size constraint parsing, and live progress evaluation.
• Debug Telemetry Polish: Added program version (Dendro 2.8.2) and millisecond ISO timestamps to -d / --debug console logs.

Acknowledgments

Special thanks to Ricky Tigg (@Ricky-Tigg) for detailed diagnostic logs, telemetry suggestions, event traces, and thorough bug reporting on issue #38.

Full Changelog: v2.8.1...v2.8.2

v2.8.1: Header Metric Alignment, Vector Theme Toggle & Toolbar Polish

Dendro 2.8.1: Header Metric Alignment, Vector Theme Toggle & Toolbar Polish

Summary of Changes

• Vector Theme Toggle & Dark Mode Contrast Fix: Replaced desktop environment weather symbolic icons with resolution-independent vector Sun (#fab387 amber) and Moon (#1e66f5 sapphire) icons rendered directly via QPainterPath. This resolves the dark-mode visibility defect caused by GNOME/Adwaita's hardcoded #2e3436 charcoal fills while eliminating external theme dependencies for critical UI chrome.
• Unified 30px Header Button Height: Resolved vertical height mismatches where the theme toggle button and the primary "Upgrade All" button rendered 4 pixels taller than neighboring toolbar buttons. Standardized all header controls (HeaderToolBtn, UpdatesIndicatorBtn, and ApplyButton) to an exact 30px outer height.
• Streamlined Updates View Toolbar: Removed the redundant "Show All Packages" button from the header bar when reviewing updates. The header "Updates (X)" indicator pill now serves as the single toggle to enter and exit the updates review list, freeing up horizontal toolbar space and preventing layout wrapping on compact laptop displays.
• Defensive Icon Candidate Resolution: Replaced Python chained or expressions for QIcon.fromTheme() lookups with a dedicated _find_theme_icon helper that explicitly checks .isNull(), ensuring candidate fallbacks are properly evaluated.

Verification & Packaging

• RPM Build: Verified clean %prep, %build, and %check phases under Fedora 40+ mock configurations.
• AppStream Validation: Verified appstreamcli validate --no-net data/io.github.xyasharx.Dendro.metainfo.xml.
• Desktop Entry Validation: Passed desktop-file-validate data/io.github.xyasharx.Dendro.desktop.

Full Changelog: v2.8.0...v2.8.1

v2.8.0 — Remote Software Installation, File Ownership Lookup & Fast Startup

Dendro 2.8.0 — Remote Software Installation, File Ownership Lookup & Fast Startup

Summary

Dendro 2.8.0 transforms Dendro into a complete software manager with on-demand remote package installation, adds native file ownership resolution (rpm -qf), introduces interactive dependency navigation, eliminates the 9-second startup bottleneck, and delivers polished two-theme switching with full light/dark contrast synchronization.

---

Key Improvements & Features

1. On-Demand Remote Package Search & Installation

• Remote Software Discovery: Search for uninstalled packages directly from enabled Fedora, RPM Fusion, and COPR repositories without preloading 75,000 packages into memory.
• Streamlined Installation Pipeline: Press Enter in the search bar (or click the trailing repository search icon) to query DNF5 in the background. Remote results appear with the Available badge and can be reviewed, simulated, and installed via Polkit with live streaming terminal logs.

2. Native File Ownership Queries (rpm -qf in Search)

• Typing any file path starting with / or file: (e.g. /usr/bin/git or /usr/lib64/libpng16.so.16) performs a sub-millisecond B-Tree index lookup via native librpm basenames and selects the owning package in the tree.

3. Interactive "Jump to Package" Navigation

• Double-clicking any dependency node in the central tree view jumps directly to that package.
• Double-clicking any dependent package in the Inspector's "Required By" tab navigates directly to it, automatically adjusting category filters if the destination package resides in another system pillar.

4. Maintainer Scriptlet Audit Tab (%pre, %post)

• Added a dedicated "Scripts" tab in the Inspector panel displaying pre-install, post-install, pre-uninstall, and post-uninstall shell code in fixed-width monospace font to audit package hooks before installation.

5. Sub-Second Startup Optimization

• Fixed 9-Second Startup Delay: Optimized AppStreamCatalog._parse_appstream_file() by clearing root element references during XML iterparse. This prevents Python from accumulating a 50MB DOM in memory, dropping catalog load times from 7+ seconds to under 400 milliseconds.

6. Theme Engine Polish & Contrast Fixes

• Streamlined 2-Theme System: Consolidated into two curated palettes (Dark and Light) with a 1-click Sun/Moon toggle button in the header toolbar, while retaining automatic system synchronization by default.
• GNOME Light Mode Switching: Resolved an issue where switching from Dark to Light mode in GNOME failed on the first toggle due to GNOME's 'default' setting.
• Eliminated Titlebar Flickering: Removed premature theme fallbacks in main.py so the window title bar opens cleanly in the correct theme without alternating.
• Dynamic Console & Table Contrast: Removed hardcoded dark hex colors from the Dry Run simulation console, DNF transaction history table, and drawer progress bars, ensuring all widgets adapt dynamically to light themes without dark-navy contrast clashes.

7. State & Memory Management

• Post-Transaction Synchronization: Fixed an issue where the Inspector panel continued displaying removed packages and header action buttons remained enabled after transaction completion.
• Butter-Smooth Scrolling: Precomputed palettes in SidebarItemDelegate to eliminate repetitive subprocess calls during painting, restoring smooth 60fps scrolling.
• Copy Dependency Chain: Added a right-click context menu action to copy formatted dependency trees directly to the clipboard.

---

Verification & Quality Assurance

# Verify static code analysis (zero undefined names)
ruff check . --select F821,F822,F823

# Run test suite headlessly
QT_QPA_PLATFORM=offscreen pytest -v tests/

**Full Changelog**: https://github.com/xyasharx/Dendro/compare/v2.7.1...v2.8.0

v2.7.1 — GTK 3 Theme Startup Race Condition Fix & Monospace Console Polish

Dendro 2.7.1 — GTK 3 Theme Startup Race Condition Fix & Monospace Console Polish

Summary

Dendro 2.7.1 fixes a critical startup race condition where GTK 3 and Wayland desktop portal handshakes caused the UI to briefly default to light mode on launch (Issue #38 follow-up), eliminates duplicate D-Bus app ID registration warnings, and standardizes fixed-width monospace fonts across all technical log consoles and tables.

---

Key Improvements & Fixes

1. GTK 3 Theme Startup Race Condition Resolved (Issue #38 Follow-up)

• The Problem: On Wayland and GTK 3 desktop environments, Qt 6's asynchronous QStyleHints::colorScheme() check occasionally returned light mode before the D-Bus portal handshake completed, causing Dendro to launch in light mode until settings were toggled.
• The Fix: Refactored is_system_dark_mode() in ui/styles.py to synchronously query host desktop settings (gsettings, gdbus appearance color-scheme, settings.ini) before window creation. The correct theme palette is now applied on the very first rendered frame.
• Portal Registration Warning: Configured application identity prior to QApplication instantiation to eliminate the Connection already associated with an application ID DBus error.

2. Monospace Typography Standardization across Consoles

• Applied the native system fixed-width monospace font (QFontDatabase.SystemFont.FixedFont) to:
  • The Dry Run Simulation Dialog console output.
  • Repository identifiers in the Software Repository Manager.
  • Command lines, transaction IDs, and dates in the DNF Transaction History viewer.

3. Code Polish & Syntax Cleanup

• Removed duplicate event loop timer initialization in main.py.
• Fixed layout indentation syntax in ui/dry_run_dialog.py.

---

Verification & Quality Assurance

# Verify static code analysis (zero undefined names)
ruff check . --select F821,F822,F823

# Run test suite headlessly
QT_QPA_PLATFORM=offscreen pytest -v tests/

**Full Changelog**: https://github.com/xyasharx/Dendro/compare/v2.7.0...v2.7.1