release: 0.5.0-beta.1

CHANGELOG.md

@@ -7,8 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0-beta.1] - 2026-10-18
+
 ### Added
 
+- **Beta channel** — the first pre-release line. A version like `0.5.0-beta.1` is published as a GitHub pre-release: only users on *Preferences → Release channel → Beta / Early Access* are offered it, Stable users, AUR, the APT / DNF repositories and Flathub never see it, and the final `0.5.0` replaces it for everyone. Beta always offers the **highest** version (it used to take the first release by date, so a hotfix published after a beta hid the beta, #1493); a beta `.deb` / `.rpm` is versioned `0.5.0~beta.1` so the final package upgrades it (#1492, #1493, #1494, #1495, #1496, #1498; see [docs/tags-and-releases.md](docs/tags-and-releases.md)).
+- **A copy of your local data before every in-app update** — `querya.db.pre-<from>-<to>.bak` next to the database, newest three kept; if the copy fails you are asked before the update goes on. A database written by a newer version is refused and left untouched (the startup screen says so), and on Snap, Flatpak, AUR, `.deb` and `.rpm` installs the Release channel row is disabled with the reason (#1497).
+- **macOS: Finder "Open With" and double-click open `.sql` and SQLite files**, at launch and in a running app. Also a macOS build check on pull requests that touch `macos/` (#1589).
+- **macOS: the App Sandbox is detected** — in a sandboxed (debug or store-style) run the in-app update refuses to replace the app and points to the release page, and the MCP and Extensions sections of Preferences say why they cannot work (#1593).
+- **Readable query errors** — the headline is the driver's message (`no such column: u.name`), the full text sits behind *Show details* without the statement Querya wraps around your SQL, and *Copy error* copies it (#1557).
+- **Toasts animate out, the welcome tour slides in the direction you move**, and a button label that does not fit shows in full as a tooltip (#1645, #1689).
+- **`MacOsSandbox`, `UpdateBackup`, `check_release.sh` and `prepare_beta.sh`** for the release process (#1498): a tag can be checked before it is pushed, and a release branch runs the check in CI.
 - **`querya-ext-tester --strict`** — warnings fail the run (exit 1), for example a recommended method that errors or an OS sandbox that could not be applied; with `--sandbox` in CI a green run now means the plugin really ran isolated. The `test-extension` action has a matching `strict` input.
 
 - **Extension registry** — `StaticRegistryRepository` reads a static `index.json` published by [QueryaHub/extensions](https://github.com/QueryaHub/extensions) (GitHub Pages): yanked entries, non-GitHub-release URLs and extensions the running version is too old for are hidden, the index is cached, installs keep the SHA-256 / archive / sandbox checks. The Extensions → Marketplace tab now shows this catalog instead of the built-in demo one (which listed fake extensions and wrote placeholder folders into the real extensions directory, #1568); while the registry is empty or unreachable the tab says so, with a *Retry*. Also new for extension authors: the `ghcr.io/queryahub/features/querya-ext-tester` Dev Container Feature, `querya-testdb-*` test database images, and the [extension template](https://github.com/QueryaHub/extension-template). See [docs/extension-registry.md](docs/extension-registry.md).
@@ -19,10 +28,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Faster grid filtering, selection copy and CJK text** — a filter parses a cell as a number only when its target is one, and its operator is resolved once; copying a selection as JSON, CSV or TSV skips work on plain text; CJK text in grid cells lays out about 40x faster because the cell font stack now names CJK families (#1553, #1550, #1519).
+- **Large JSON / XML cells open without freezing** — from 256 KB the inspector checks, formats and minifies them on a worker (#1688).
+- **Smaller wins** — Redis folder counts are counted once instead of on every rebuild, group sums read `1,234.5` without copying the cell, the ERD relation painter reuses its paint, paths and labels, and editor token styles are shared (#1518, #1543).
 - **Faster result grids** — sorting a timestamp column of 50,000 rows ~400 ms → ~60 ms (#1533); choosing column types for a 5,000-row result ~3.5 ms → ~0.5 ms (#1548); selection statistics read `1,234.5` without copying the cell (#1520); copying a large result to the clipboard no longer stops the UI for 20–30 ms while it is handed to the background (#1537).
 
 ### Fixed
 
+- **Security: the SQL statement splitter read PostgreSQL and SQLite literals with MySQL rules** — in `'a\'; SELECT pg_terminate_backend(1); --'` it saw one statement with a long literal, while the server runs the second one. The MCP read-only guard, the destructive-query confirmation and the mutation audit's classifier now follow the connection's dialect (`E'...'` strings keep their escape everywhere). The guard also refuses `QUERY_TO_XML*`, `TABLE_TO_XML*`, `PG_ADVISORY_*`, `PG_SLEEP*`, `LO_*`, `NEXTVAL` and `SETVAL`, and no longer refuses `EXPLAIN SELECT REPLACE(...)` (#1687, #1565).
+- **A failed extension upgrade keeps the working extension** — it is extracted next to the old one, checked, and only then swapped in; the Marketplace and the local installer share this path and no longer mix files of two versions. Archive entries under `../` are refused before the common folder is stripped (#1562).
+- **Extension `engines` ranges accept `>= 0.4.0 < 3.0.0`** with spaces after the operator (#1635, #1636).
+- **MCP server: overlapping start / stop calls** could leave a second socket host listening; they now run one after another. A connection that never sends its token is cut off after 4 KiB and at most 16 wait at once (#1563, #1565).
+- **Importing a team profile with a malformed field** failed with a crash; the entry is skipped and counted. More secret names are scrubbed (`pwd`, `private_key`, `access_key`, `credential`, `signature`) (#1564).
+- **The status bar no longer keeps "Running query…"** after a plain row-count result (#1556).
+- **MongoDB `find` is never unbounded** — `.limit(0)` is capped at 1,000 documents and the summary says so (#1357).
+- **Declarative extension modules** read JSONC with `//` inside strings and trailing commas, and format SQL without touching literals (#1567).
+- **macOS:** the Copy menu item works, the extension sandbox profile names the real path (`/var` is a link) and escapes it, and an update must be signed by the same Team ID as the installed app (#1590, #1588).
+- **Dialogs fit small windows** — the destructive-query dialog follows the window and the UI scale, and a long table name in the DML preview is cut (#1642).
+- **Smaller fixes** — a TLS client key file whose `chmod` failed is no longer used, audit-log and preferences read failures are logged, `docs/getting-started.md` no longer suggests `flutter create .` (#1637, #1501).
 - **Redis: a command can no longer run in another database** — every explorer of a connection shared one socket and sent `SELECT n` before each command, so switching to db3 while a folder delete in db0 was running sent the remaining deletes to db3, and a `SELECT` typed in the CLI was undone by the next key you opened while the prompt still showed the old database. Each database now has its own socket (selected again after a reconnect), and the CLI has its own. Folder delete uses `UNLINK` (falls back to `DEL` before Redis 4.0), pipelines its chunks and reloads the list if a chunk fails (#1569).
 - **macOS in-app update no longer quits into a broken or missing app** — when the app could not be moved aside (no write access to its folder, a disk image, a copy macOS runs from a temporary location) the update copied the new app *into* the old one, and a failed copy left no app at all. The update dialog now says up front when the app cannot be replaced and offers the release page; otherwise the old app is restored if the copy fails, the failure is logged to `~/Library/Logs/Querya/querya-update.log` and the app opens again. The leftover `.old` bundle and the extracted update are removed (#1587).
 - **macOS builds without Developer ID signing no longer run in the App Sandbox** — they did, unlike the signed build, so `~/.querya` (extensions, themes), `~/.ssh` keys, saved SQLite files, the MCP endpoint and in-app updates did not work. Unsigned and signed builds now differ only in how Gatekeeper treats them, and the release fails if the sandbox comes back (#1592).

pubspec.yaml

@@ -1,7 +1,7 @@
 name: querya_desktop
 description: Lightweight desktop SQL/NoSQL client. Flutter (Dart).
 publish_to: 'none' # app, never published to pub.dev (allows path dependencies)
-version: 0.4.22+5
+version: 0.5.0-beta.1+6