Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review for PR #41: Bump package versions to latest upstream releases

• Repository: mas-bandwidth/apt
• PR Number: Bump package versions to latest upstream releases #41
• Head SHA: 236c7e640202958f75a7a6d5a2ddea20e2e43246
• Base: origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d)
• Score: 7/10
• Verdict: HOLD

---

Executive Summary

PR #41 was generated automatically by check-releases.yml on 2026-08-28 to bump pinned library versions in versions.env:

• RELIABLE_VERSION: 1.4.0 -> 1.4.1
• NETCODE_VERSION: 1.4.3 -> 1.4.4
• YOJIMBO_VERSION: 1.10.1 -> 1.11.0
• (SERIALIZE_VERSION remained at 1.15.0, SCHEMA_VERSION remained at 2.0.0)

The changes in this PR are technically sound and verified: all 10 matrix build targets and autopkgtest-schema built and passed in CI run 33174232220. However, this PR is now 24 days old and has been superseded by 24 subsequent daily bump PRs (through PR #65). Current upstream releases have advanced significantly (serialize 1.17.0, reliable 1.4.5, netcode 1.4.8, yojimbo 1.13.5, schema 2.5.0).

Recommendation: HOLD / Close without merging as superseded by the latest bump branch (PR #65).

---

Detailed Verification Evidence

1. 3-Way Merge & Git Status

• Clean merge against origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d).
• Command:

  git merge-tree --write-tree origin/main 236c7e640202958f75a7a6d5a2ddea20e2e43246

  Resulting merge tree: 8e339985f4877961abfae1851bab09950a6f1514 (exit code: 0).
• Diff verification: Strictly isolated to versions.env (+3 / -3 lines).
• Release tarball availability verified via HTTP HEAD:
  • mas-bandwidth/reliable v1.4.1: HTTP 200
  • mas-bandwidth/netcode v1.4.4: HTTP 200
  • mas-bandwidth/yojimbo v1.11.0: HTTP 200
  • mas-bandwidth/serialize v1.15.0: HTTP 200
  • mas-bandwidth/schema v2.0.0: HTTP 200
• Packaging dependencies in packages/yojimbo/debian/control (libserialize-dev >= 1.4, libreliable-dev >= 1.3, libnetcode-dev >= 1.3.2) are fully satisfied.

2. Upstream Release Verification & Staleness

Ran ./scripts/check-releases.sh at commit 236c7e640202958f75a7a6d5a2ddea20e2e43246:

• Output:

  serialize: pinned 1.15.0, latest 1.17.0
  reliable: pinned 1.4.1, latest 1.4.5
  netcode: pinned 1.4.4, latest 1.4.8
  yojimbo: pinned 1.11.0, latest 1.13.5
  schema: pinned 2.0.0, latest 2.5.0
  

• Exit code: 1 (all 5 pinned dependencies are behind current upstream releases).
• The PR is superseded by subsequent daily bumps through PR Bump package versions to latest upstream releases #65 (bump-versions-20260921).

3. Remote CI Results & Build Implications

In GitHub Actions workflow run 33174232220 (triggered via workflow_dispatch on bump-versions-20260828 at 236c7e640202958f75a7a6d5a2ddea20e2e43246):

• autopkgtest-schema: Succeeded (47s, ID 98858603770)
• All 10 matrix build configurations succeeded:
  • build (debian:12, arm64) (1m35s, ID 98858604027)
  • build (debian:12, amd64) (1m34s, ID 98858604120)
  • build (debian:13, arm64) (1m44s, ID 98858604016)
  • build (debian:13, amd64) (1m57s, ID 98858604048)
  • build (ubuntu:22.04, arm64) (2m01s, ID 98858603919)
  • build (ubuntu:22.04, amd64) (2m03s, ID 98858604070)
  • build (ubuntu:24.04, arm64) (1m58s, ID 98858604088)
  • build (ubuntu:24.04, amd64) (2m12s, ID 98858604042)
  • build (ubuntu:26.04, arm64) (2m10s, ID 98858604110)
  • build (ubuntu:26.04, amd64) (2m10s, ID 98858604243)
• Packaging artifacts (debs-* for all 5 distros on amd64 & arm64) were cleanly produced and uploaded.
• publish job: Exited with failure due to GitHub Pages environment protection rules (Branch "bump-versions-20260828" is not allowed to deploy to github-pages). As documented in build.yml, pages deployment is reserved for main.
• Pull request event runs (33174233412, 33174233360) halted on action_required pending external workflow execution approval.

4. Negative Controls / Red-Tests

• Script sensitivity test:
  • Mutated versions.env locally with RELIABLE_VERSION=99.99.99. ./scripts/check-releases.sh detected the mismatch immediately, outputting reliable: pinned 99.99.99, latest 1.4.5 and exiting with code 1.
  • Verified fictitious release tag curl test: querying https://github.com/mas-bandwidth/reliable/archive/refs/tags/v99.99.99.tar.gz returned HTTP 404, confirming build-package.sh would fail fast if given a bad tag.
  • Ran ./scripts/check-releases.sh --update in the scratch worktree, confirming that updating pinned versions to current upstream releases brings versions.env to current state.
  • Re-tested with ./scripts/check-releases.sh, confirming that it outputs all pinned versions are current and exits with code 0.
• Worktree integrity: Scratch worktree was restored cleanly and verified before teardown (git status --porcelain clean).

---

Conclusion & Disposition

Commit 236c7e640202958f75a7a6d5a2ddea20e2e43246 was verified to build and test cleanly on its branch. However, because upstream releases have continued to advance over the past 24 days, merging PR #41 would publish obsolete intermediate packages and immediately trigger subsequent bump PRs.

Recommended action: Close PR #41 without merge as superseded by the latest bump branch (PR #65).

READ-COST: reader=Emma model=gemini-2.5-pro seconds=360 tokens=unknown plan=max