fix(update): a run of dev builds could hide stable releases

[over2take]

The check read one page of a hundred registry tags. Tags come back ordered by recency rather than by version, so publishing a hundred development builds after a release fills that page with X.Y.Z-dev.N — every one of which a stable deployment filters out. It is then left with no version tags at all and reports "you're up to date" to someone who is not.

Worth fixing ahead of what the arithmetic suggests, because of how it fails: silently, only for people on older versions, only on the stable channel, with nothing logged anywhere. That is the signature of the bug that started this work.

It now follows the next page, but only while it has found nothing usable. In the ordinary case the newest release is on the first page and this makes exactly one request, as before. Bounded at five pages so a registry that keeps offering another cannot hang the request, and it rejects rather than resolving empty on an unparseable response — resolving empty would be indistinguishable from "nothing published" and would report the same false reassurance.

The fetch moved into updater.js, where it can be tested; the route was the only place it could live before and could not be exercised. Eight tests, and I checked the important one fails with paging disabled rather than assuming it exercises anything.

Summary

Test plan

• Tested locally
• Tests pass

Pre-merge checklist

Code quality:

• Code follows project style
• No breaking changes (or clearly documented)
• No console errors or warnings

Version & Release:

• Version bumped? If releasing to users, update:
  • frontend/package.json version
  • docker-compose.yml APP_VERSION
  • CHANGELOG.md with release notes
• GitHub Actions will auto-tag Docker images with the new version

Before merging to main:

• All tests passing
• PR reviewed and approved
• Branch is up to date with main
• No merge conflicts

Related issues