Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review of PR #42: Bump package versions to latest upstream releases

Head SHA: e956c76b18ca3f37433b647cf4696c4293a94bfe
Base: origin/main
Verdict: HOLD
Score: 6/10

---

Summary

PR #42 is an automated version bump generated by check-releases.yml on 2026-08-29 updating versions.env:

• RELIABLE_VERSION: 1.4.0 -> 1.4.1
• NETCODE_VERSION: 1.4.3 -> 1.4.4
• YOJIMBO_VERSION: 1.10.1 -> 1.11.0
• SERIALIZE_VERSION (1.15.0) and SCHEMA_VERSION (2.0.0) unchanged.

While this commit cleanly merges against origin/main and successfully builds all 10 distro/arch matrix targets in CI, this PR is 23 days old and has been superseded by subsequent upstream releases and newer daily bump PRs (through PR #65). Merging PR #42 today would release stale packages.

---

Verification Evidence

1. 3-Way Merge Simulation

Verified 3-way merge against origin/main using git merge-tree:

git merge-tree --write-tree origin/main e956c76b18ca3f37433b647cf4696c4293a94bfe
# Output tree: 8e339985f4877961abfae1851bab09950a6f1514 (Exit code 0)

The tree merges cleanly with no git conflicts. Commit e956c76b18ca3f37433b647cf4696c4293a94bfe directly parents to origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d).

2. Diff & Upstream Tarball Verification

Inspected diff against base (versions.env):

• RELIABLE_VERSION: 1.4.0 -> 1.4.1
• NETCODE_VERSION: 1.4.3 -> 1.4.4
• YOJIMBO_VERSION: 1.10.1 -> 1.11.0

Verified that upstream GitHub release archive tarballs exist and respond with HTTP 200:

• mas-bandwidth/reliable v1.4.1: HTTP 200
• mas-bandwidth/netcode v1.4.4: HTTP 200
• mas-bandwidth/yojimbo v1.11.0: HTTP 200
• mas-bandwidth/serialize v1.15.0: HTTP 200
• mas-bandwidth/schema v2.0.0: HTTP 200

3. Remote CI Results & Build Implications

Inspected GitHub Actions runs for commit e956c76b18ca3f37433b647cf4696c4293a94bfe:

• Pull request event runs (33245378857 and 33245378870) were paused with action_required due to GitHub Actions bot PR execution policy.
• Workflow dispatch run 33245377991 (build workflow) executed all build jobs:
  • autopkgtest-schema on debian:13: Passed (49s)
  • All 10 packaging matrix legs (debian:12, debian:13, ubuntu:22.04, ubuntu:24.04, ubuntu:26.04 on both amd64 and arm64): All 10 Passed
  • Note: Unlike later Yojimbo versions (v1.12.1+ which broke out-of-tree tests in debian rules), Yojimbo 1.11.0 builds and tests cleanly.
  • The publish job failed with Branch "bump-versions-20260829" is not allowed to deploy to github-pages due to environment protection rules, which is expected behavior for non-main branches under environment protection (and guarded by if: github.event_name != 'pull_request' in standard PR triggers).

4. Upstream Freshness Check (check-releases.sh)

Ran ./scripts/check-releases.sh in the isolated worktree tracking e956c76b18ca3f37433b647cf4696c4293a94bfe:

serialize: pinned 1.15.0, latest 1.17.0
reliable: pinned 1.4.1, latest 1.4.5
netcode: pinned 1.4.4, latest 1.4.8
yojimbo: pinned 1.11.0, latest 1.13.5
schema: pinned 2.0.0, latest 2.5.0

Exit code: 1 (indicating that all pinned packages are now stale compared to latest upstream releases).

5. Negative Controls / Sensitivity Verification

Verified test sensitivity of the repository scripts:

• Negative Control 1 (Invalid upstream version in versions.env): Mutated SERIALIZE_VERSION=99.99.99. ./scripts/check-releases.sh flagged serialize: pinned 99.99.99, latest 1.17.0 and exited with code 1.
• Negative Control 2 (Tarball fetch failure): Attempted fetching v99.99.99 tarball (curl -fsSL https://github.com/mas-bandwidth/serialize/archive/refs/tags/v99.99.99.tar.gz), confirming failure with exit code 56 (HTTP 404).
• Positive Control (Current upstream alignment): Temporarily updated all 5 package versions in versions.env to current upstream releases (serialize 1.17.0, reliable 1.4.5, netcode 1.4.8, yojimbo 1.13.5, schema 2.5.0). ./scripts/check-releases.sh returned all pinned versions are current and exited with code 0.
• All modifications were restored cleanly.

---

Recommendation

HOLD / SUPERSEDED:
This PR should not be merged because it has been superseded by newer upstream releases and open daily bump PRs (most recently PR #65). This PR can be safely closed once current bump PRs are resolved.

READ-COST: reader=Emma model=gemini-2.5-pro seconds=175 tokens=unknown plan=max