Update Dashboard widget shows unreleased (and unstable versions)

[wuuti]

Bug report

Summary

The update widget does not show the correct versions to update to.

Step to reproduce

Either install a previous 3.x version, or mock your local version by changing the local values in /core/docs/version.inc.php, e.g. to 3.0.0-alpha2. See that the widget is showing you an update, although the latest published release is -alpha2.

Observed behavior

• the widget shows you that an update is available to version 3.0.0-alpha3. But this is the current build version, and has not yet been released (at the time of writing here). Therefore also the click on the update button (wrong label!), which leads you to the download page, is kind of useless, as it does not offer a zip to download for the version (you would need the nightly build).
• as the update information is gathered from the build file in the 3.x branch, it will always show you that an update is available - unless you are using a git installation, which potentially - if you pulled recently, contains the same version information. In all other cases, mainly normal installations, the repo buildfile will always be ahead of the recently released tarballs...
• the widget will show you core updates available regardless of the patch level here. Most people will only be interested in stable versions, so only those updates should be shown.

Expected behavior

• widget should get its information for released versions (exception: if you have a git based install, it may be ok to show the nightly upcoming version)
• widget should show you only stable versions (with a system setting allowing you to optin to unstable versions if you want)
• as long as no update is possible inplace (probably never), the button should be renamed to "To Download" or something. We could also directly offer the download for the correct tarball, because those links are constructable easily.

Environment

MODX version: 3.x (git)

[wuuti]

I am already working on that, because most of the problems have already been solved with the updater extra. As this extra does not make sense any more for the 3.x version, I decided not to work on that any more regarding 3 compatibility, instead spend the time better to improve this - now being core - functionality.

[Mark-H]

Looks like it requests https://raw.githubusercontent.com/modxcms/revolution/3.x/_build/build.xml, which gets updated for building nightlies after each release 🙈

File is in manager/controllers/default/dashboard/widget.updates.php for anyone else struggling to find it.

@opengeek I know there was talk of a new API for versions and nightlies, is that something that's already to use for this instead? If not we'll have to find a different place to fetch the latest release number.

[opengeek]

Yeah, I just looked up the code and then cursed a lot. There is not an endpoint for versions and nightlies, but we can define the requirements and I can add one.

[Mark-H]

Simplest solution would be a modx.com/latest/v3.txt that returns the signature, but could also make it a /latest/v3.json that has the signature, release date, link to announcement etc for a more versatile solution. Or an rss feed of releases, I think that might already be there (or was that just for nightlies?).

[opengeek]

Simplest solution would be a modx.com/latest/v3.txt that returns the signature, but could also make it a /latest/v3.json that has the signature, release date, link to announcement etc for a more versatile solution. Or an rss feed of releases, I think that might already be there (or was that just for nightlies?).

The RSS is for nightlies, but I don't want that public as it is not super efficient. I want a proper endpoint in the API, not the website.