Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review of PR #44 (Bump package versions to latest upstream releases)

Score: 5/10
Verdict: HOLD
Head SHA: cffc93bc4a881f13aed2ddf8f1f5bd4379fcfc8e (branch: bump-versions-20260831)
Base: origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d)

Executive Summary

PR #44 was automatically opened on 2026-08-31 by check-releases.yml to bump pinned dependency versions in versions.env:

• RELIABLE_VERSION: 1.4.0 -> 1.4.1
• NETCODE_VERSION: 1.4.3 -> 1.4.4
• YOJIMBO_VERSION: 1.10.1 -> 1.11.0
• SCHEMA_VERSION: 2.0.0 -> 2.1.0
• (SERIALIZE_VERSION remained at 1.15.0)

While the changes in this PR were completely valid at the time of creation (all 10 matrix build targets and autopkgtest passed in CI), this PR is now 21 days old and has been superseded by 21 subsequent daily bump PRs (through PR #65). Current upstream releases have advanced significantly (serialize 1.17.0, reliable 1.4.5, netcode 1.4.8, yojimbo 1.13.5, schema 2.5.0).

Recommendation: HOLD / Close without merging as superseded by the latest bump branch (PR #65), once the packaging fix for yojimbo 1.13.5 is applied.

---

Detailed Verification Evidence

1. 3-Way Merge & Git Status

• Clean merge against origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d).
• Command:

  git merge-tree --write-tree origin/main cffc93bc4a881f13aed2ddf8f1f5bd4379fcfc8e

  Result tree: febf465595367655e2f001bfab0af6b25415992d (exit code: 0).
• Diff verification: Strictly isolated to versions.env (+4 / -4 lines).

2. Upstream Release Verification & Staleness

Ran ./scripts/check-releases.sh at commit cffc93bc4a881f13aed2ddf8f1f5bd4379fcfc8e:

• Output:

  serialize: pinned 1.15.0, latest 1.17.0
  reliable: pinned 1.4.1, latest 1.4.5
  netcode: pinned 1.4.4, latest 1.4.8
  yojimbo: pinned 1.11.0, latest 1.13.5
  schema: pinned 2.1.0, latest 2.5.0
  

• Exit code: 1 (all 5 pinned dependencies are behind upstream).
• The PR is superseded by PR Bump package versions to latest upstream releases #65 (bump-versions-20260921).

3. Remote CI Results & Build Implications

In GitHub Actions workflow run 33378290104 (triggered via workflow_dispatch on bump-versions-20260831 at cffc93bc4a881f13aed2ddf8f1f5bd4379fcfc8e):

• autopkgtest-schema: Succeeded (52s, ID 99444623015)
• All 10 matrix build configurations succeeded:
  • build (ubuntu:26.04, arm64) (2m0s)
  • build (debian:13, amd64) (1m42s)
  • build (ubuntu:22.04, arm64) (1m48s)
  • build (debian:12, arm64) (1m32s)
  • build (ubuntu:22.04, amd64) (2m9s)
  • build (ubuntu:24.04, amd64) (2m9s)
  • build (debian:13, arm64) (1m45s)
  • build (ubuntu:24.04, arm64) (2m0s)
  • build (ubuntu:26.04, amd64) (2m13s)
  • build (debian:12, amd64) (1m44s)
• Packaging artifacts (debs-* for all 5 distros on amd64 & arm64) were cleanly produced.
• publish job: Exited with failure due to GitHub Pages environment protection rules (Branch "bump-versions-20260831" is not allowed to deploy to github-pages). As documented in build.yml, deployment is reserved for main.
• Note on yojimbo: At YOJIMBO_VERSION=1.11.0, packages/yojimbo/debian/rules built cleanly. The upstream test path break did not occur until 1.13.5.

4. Negative Controls / Red-Tests

• Script sensitivity test:
  • Ran ./scripts/check-releases.sh --update in a temporary test copy, confirming that when all pinned versions match current upstream, the script outputs all pinned versions are current and exits with code 0.
  • Mutated versions.env locally with SERIALIZE_VERSION=0.0.0. ./scripts/check-releases.sh detected the discrepancy immediately, outputting serialize: pinned 0.0.0, latest 1.17.0 and exiting with code 1.
• Worktree integrity: Confirmed scratch worktree restored to clean detached HEAD state matching cffc93bc4a881f13aed2ddf8f1f5bd4379fcfc8e.

---

Conclusion & Disposition

Technically, the commit built and tested successfully on its branch. However, because upstream releases have continued to ship over the intervening 3 weeks, merging PR #44 would publish obsolete packages and trigger immediate subsequent bump PRs.

Recommended action: Close PR #44 as superseded by PR #65.

READ-COST: reader=Emma model=gemini-2.5-pro seconds=122 tokens=unknown plan=max