Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review of PR #38 (Bump package versions to latest upstream releases)

Score: 3/10
Verdict: HOLD
Head SHA: eda85735c383a914cff4325d89a31a1a9a519d58 (branch: bump-versions-20260826)
Base: origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d)

Executive Summary

PR #38 is an automated bump PR opened by github-actions[bot] on 2026-08-26 to advance:

• RELIABLE_VERSION: 1.4.0 -> 1.4.1
• NETCODE_VERSION: 1.4.3 -> 1.4.4
• YOJIMBO_VERSION: 1.10.1 -> 1.11.0

While the diff is syntactically clean and cleanly merges with origin/main, this PR has been completely superseded by newer releases over the past 26 days. As of 2026-09-21, upstream releases have advanced significantly further (reliable 1.4.5, netcode 1.4.8, yojimbo 1.13.5, serialize 1.17.0, schema 2.5.0), and active bump PRs (such as PR #65) are already tracking the latest versions.

Merging PR #38 would trigger a full matrix rebuild and publish outdated intermediate packages. PR #38 should be closed as superseded.

---

Detailed Verification Evidence

1. 3-Way Merge & Git Status

• Clean 3-way merge against origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d):
  git merge-tree --write-tree origin/main eda85735c383a914cff4325d89a31a1a9a519d58
  Result tree: 8e339985f4877961abfae1851bab09950a6f1514 (exit code: 0).
• Diff verification: Strictly isolated to versions.env (+3 / -3 lines).

2. Check-Releases Script Verification

Ran ./scripts/check-releases.sh at commit eda85735c383a914cff4325d89a31a1a9a519d58:

• Result: Exited with code 1 (stale).
• Output:

  serialize: pinned 1.15.0, latest 1.17.0
  reliable: pinned 1.4.1, latest 1.4.5
  netcode: pinned 1.4.4, latest 1.4.8
  yojimbo: pinned 1.11.0, latest 1.13.5
  schema: pinned 2.0.0, latest 2.5.0
  

All 5 upstream repositories have newer releases available than the versions pinned in this PR.

3. Remote CI Results & Build Implications

Checked remote CI runs for branch bump-versions-20260826 (gh run list --repo mas-bandwidth/apt --branch bump-versions-20260826):

• PR workflow runs for commit eda85735c383a914cff4325d89a31a1a9a519d58 (run ID 32953193609 for official, 32953193566 for build) show conclusion action_required because bot-initiated PRs require manual approval to run workflows.
• Earlier on the branch, PR checks (32924095131 and 32924095126) passed across the 10-target matrix (Debian 12/13, Ubuntu 22.04/24.04/26.04 on amd64 and arm64).
• A manual workflow_dispatch run (32928920925) succeeded on all matrix build and smoke test jobs, failing only at the publish job because GitHub Pages publication is restricted to main.
• Merging PR Bump package versions to latest upstream releases #38 would trigger build.yml on main, rebuilding and publishing packages for versions that are now 26 days behind upstream.

4. Negative Controls / Red-Tests

• Update / Green check: Ran ./scripts/check-releases.sh --update which updated versions.env to the current latest upstream releases (1.17.0, 1.4.5, 1.4.8, 1.13.5, 2.5.0). Re-running ./scripts/check-releases.sh confirmed all pinned versions are current with exit code 0.
• Sensitivity test (Red test): Mutated versions.env to set RELIABLE_VERSION=0.0.0. ./scripts/check-releases.sh detected the mismatch immediately, printed reliable: pinned 0.0.0, latest 1.4.5, and exited with status 1.
• Restored worktree cleanly to eda85735c383a914cff4325d89a31a1a9a519d58.

---

Conclusion & Recommendation

Verdict is HOLD (Recommend CLOSE as Superseded). PR #38 is obsolete; subsequent upstream releases are tracked in active daily bump PRs (such as PR #65).

READ-COST: reader=Emma model=gemini-2.5-pro seconds=155 tokens=unknown plan=max