Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review of PR #40: Bump package versions to latest upstream releases

Head SHA: 473ce0a0b620a270e8539867df57802266f07722 (branch bump-versions-20260827)
Base: origin/main (at 8ba166a "Package the schema compiler v2.0.0 (#39)")
Verdict: HOLD (Superseded by newer upstream releases / newer daily bump PRs)
Score: 7/10 (Technically clean and passes all CI build/test matrices for its pinned targets, but stale and superseded)

---

Verification Evidence

1. 3-Way Merge Integrity

• Command: git merge-tree --write-tree origin/main 473ce0a0b620a270e8539867df57802266f07722
• Result: Clean merge (exit code 0).
• Merge tree SHA: 8e339985f4877961abfae1851bab09950a6f1514. No merge conflicts against origin/main.

2. Diff Inspection (versions.env)

The single-file diff bumps three pinned C networking packages:

diff --git a/versions.env b/versions.env
index 59a504c..e84d3d4 100644
--- a/versions.env
+++ b/versions.env
@@ -1,9 +1,9 @@
 # Pinned upstream versions built and published by CI.
 # check-releases.yml compares these against the latest GitHub releases daily.
 SERIALIZE_VERSION=1.15.0
-RELIABLE_VERSION=1.4.0
-NETCODE_VERSION=1.4.3
-YOJIMBO_VERSION=1.10.1
+RELIABLE_VERSION=1.4.1
+NETCODE_VERSION=1.4.4
+YOJIMBO_VERSION=1.11.0
 SCHEMA_VERSION=2.0.0

• Upstream release tarball availability:
  • serialize v1.15.0: HTTP 200
  • reliable v1.4.1: HTTP 200
  • netcode v1.4.4: HTTP 200
  • yojimbo v1.11.0: HTTP 200
  • schema v2.0.0: HTTP 200

3. Remote CI Results & Build Implications

Inspected gh run list --repo mas-bandwidth/apt --branch bump-versions-20260827:

• Pull Request runs (build #33073593809 and official #33073593818): Sitting at action_required (expected behavior for bot-created PRs requiring maintainer approval).
• Automated dispatch run (build #33073592634):
  • All 10 distro/arch matrix builds succeeded:
    • debian:12 (amd64, arm64) — PASS
    • debian:13 (amd64, arm64) — PASS
    • ubuntu:22.04 (amd64, arm64) — PASS
    • ubuntu:24.04 (amd64, arm64) — PASS
    • ubuntu:26.04 (amd64, arm64) — PASS
  • autopkgtest-schema — PASS (1m22s)
  • publish — Failed at 1s as expected: environment protection rule rejects non-main branch deployments to github-pages. All packages and artifacts built and passed smoke tests cleanly.

4. Release Freshness & ./scripts/check-releases.sh

Running ./scripts/check-releases.sh against current upstream:

serialize: pinned 1.15.0, latest 1.17.0
reliable: pinned 1.4.1, latest 1.4.5
netcode: pinned 1.4.4, latest 1.4.8
yojimbo: pinned 1.11.0, latest 1.13.5
schema: pinned 2.0.0, latest 2.5.0

(Exit code 1: all 5 packages have newer upstream releases since this PR was opened on 2026-08-27).

5. Negative Controls / Sensitivity Testing

1. Upstream tarball resolution red-test:
   • Querying a bogus release tag (reliable v9.99.99): curl -s -o /dev/null -w "%{http_code}" https://github.com/mas-bandwidth/reliable/archive/refs/tags/v9.99.99.tar.gz returned HTTP 404.
2. Mutation sensitivity red-test:
   • Mutated versions.env to set RELIABLE_VERSION=99.9.9. ./scripts/check-releases.sh exited 1 and specifically identified reliable: pinned 99.9.9, latest 1.4.5.

---

Conclusion & Recommendation

The changes in commit 473ce0a0b620a270e8539867df57802266f07722 are syntactically and structurally correct, merge cleanly, and passed all 10 matrix builds in CI. However, PR #40 was generated on 2026-08-27 and has since been superseded by daily bumps up to PR #65 (bump-versions-20260921). Merging PR #40 would republish intermediate versions that are already superseded upstream.

Recommendation: HOLD / Close PR #40 in favor of the latest daily bump PR (PR #65).

READ-COST: reader=Emma model=gemini-2.5-pro seconds=225 tokens=unknown plan=max