Ignore versions with zero rollout in Mullvad loader and app

4 files changed, 138 insertions, 1 deletions

diff --git a/mullvad-update/src/client/snapshots/mullvad_update__client__api__test__http_version_provider.snap b/mullvad-update/src/client/snapshots/mullvad_update__client__api__test__http_version_provider.snap
index 0ab318fa1f..7f8ba8c98c 100644
--- a/mullvad-update/src/client/snapshots/mullvad_update__client__api__test__http_version_provider.snap
+++ b/mullvad-update/src/client/snapshots/mullvad_update__client__api__test__http_version_provider.snap
@@ -6,7 +6,7 @@ snapshot_kind: text
 signatures:
   - keytype: ed25519
     keyid: bb4ef63ffdcc6bd5a19c30cd23b9de03099407a04463418f17ae338b98aa09d4
-    sig: fb0f0d608f82101ca294c9150ce268c29bdaf99d4a726541e59523ef00b0d534d65cac277f1355e2838f5ac1b1f1e7013411da70049ba19a208515c67a97de06
+    sig: 4e13871919863cdc671439409dc2d08cce8cea39640eda338d180fa081a0f5675894b8a4408ce3c43115f098c1494406c96c7c326f981d1303a28720d55c310d
 signed:
   metadata_version: 0
   metadata_expiry: "2025-10-02T15:33:00Z"
@@ -67,3 +67,17 @@ signed:
     - version: "2026.10"
       changelog: ""
       installers: []
+    - version: "2030.3"
+      changelog: "[macos] Everything has been fixed"
+      installers:
+        - architecture: x86
+          urls:
+            - "https://releases.mullvad.net/desktop/releases/2025.3-beta1/MullvadVPN-2025.3-beta1_x64.exe"
+          size: 106297504
+          sha256: 0c569aa0912eb93605a85073447d42ba0ca612361bef78ef04ef038e80b15403
+        - architecture: arm64
+          urls:
+            - "https://releases.mullvad.net/desktop/releases/2025.3-beta1/MullvadVPN-2025.3-beta1_arm64.exe"
+          size: 111488248
+          sha256: 82948D3DB5B869EE5F0D246DB557A81B72B68DFDDD2267872B7B8A5B19A05444
+      rollout: 0
diff --git a/mullvad-update/src/snapshots/mullvad_update__version__test__version_unsupported_filtering-2.snap b/mullvad-update/src/snapshots/mullvad_update__version__test__version_unsupported_filtering-2.snap
new file mode 100644
index 0000000000..207c377c52
--- /dev/null
+++ b/mullvad-update/src/snapshots/mullvad_update__version__test__version_unsupported_filtering-2.snap
@@ -0,0 +1,45 @@
+---
+source: mullvad-update/src/version.rs
+expression: info
+snapshot_kind: text
+---
+stable:
+  version: "2030.3"
+  urls:
+    - "https://releases.mullvad.net/desktop/releases/2025.3-beta1/MullvadVPN-2025.3-beta1_x64.exe"
+  size: 106297504
+  changelog: "[macos] Everything has been fixed"
+  sha256:
+    - 12
+    - 86
+    - 154
+    - 160
+    - 145
+    - 46
+    - 185
+    - 54
+    - 5
+    - 168
+    - 80
+    - 115
+    - 68
+    - 125
+    - 66
+    - 186
+    - 12
+    - 166
+    - 18
+    - 54
+    - 27
+    - 239
+    - 120
+    - 239
+    - 4
+    - 239
+    - 3
+    - 142
+    - 128
+    - 177
+    - 84
+    - 3
+beta: ~
diff --git a/mullvad-update/src/snapshots/mullvad_update__version__test__version_unsupported_filtering.snap b/mullvad-update/src/snapshots/mullvad_update__version__test__version_unsupported_filtering.snap
new file mode 100644
index 0000000000..6c5a8fc498
--- /dev/null
+++ b/mullvad-update/src/snapshots/mullvad_update__version__test__version_unsupported_filtering.snap
@@ -0,0 +1,44 @@
+---
+source: mullvad-update/src/version.rs
+expression: info
+snapshot_kind: text
+---
+stable:
+  version: "2026.10"
+  urls: []
+  size: 0
+  changelog: ""
+  sha256:
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+    - 0
+beta: ~
diff --git a/mullvad-update/src/version.rs b/mullvad-update/src/version.rs
index c37c2a2d7b..13da1ec82d 100644
--- a/mullvad-update/src/version.rs
+++ b/mullvad-update/src/version.rs
@@ -216,4 +216,38 @@ mod test {
 
         Ok(())
     }
+
+    /// Test whether [SUPPORTED_VERSION] ignores unsupported versions (where rollout = 0.0)
+    #[test]
+    fn test_version_unsupported_filtering() -> anyhow::Result<()> {
+        let response = format::SignedResponse::deserialize_insecure(include_bytes!(
+            "../test-version-response.json"
+        ))?;
+
+        let params = VersionParameters {
+            architecture: VersionArchitecture::X86,
+            rollout: SUPPORTED_VERSION,
+            allow_empty: true,
+            lowest_metadata_version: 0,
+        };
+
+        let info = VersionInfo::try_from_response(&params, response.signed.clone())?;
+
+        // Expect: The available latest versions for x86, where the rollout is non-zero.
+        assert_yaml_snapshot!(info);
+
+        let params = VersionParameters {
+            architecture: VersionArchitecture::X86,
+            rollout: IGNORE,
+            allow_empty: true,
+            lowest_metadata_version: 0,
+        };
+
+        let info = VersionInfo::try_from_response(&params, response.signed)?;
+
+        // Expect: There is an even higher version where the rollout is zero.
+        assert_yaml_snapshot!(info);
+
+        Ok(())
+    }
 }