Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review of PR #45 (Bump package versions to latest upstream releases)

Score: 5/10
Verdict: HOLD
Head SHA: 823109a36880bde9b41c9ca070f5da82bb8912c5 (branch: bump-versions-20260901)
Base: origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d)

Executive Summary

PR #45 was automatically opened on 2026-09-01 by check-releases.yml to bump pinned dependency versions in versions.env:

• RELIABLE_VERSION: 1.4.0 -> 1.4.1
• NETCODE_VERSION: 1.4.3 -> 1.4.4
• YOJIMBO_VERSION: 1.10.1 -> 1.11.0
• SCHEMA_VERSION: 2.0.0 -> 2.3.0
• (SERIALIZE_VERSION remained at 1.15.0)

While the changes in this PR were completely valid at the time of creation (all 10 matrix build targets and autopkgtest passed in CI), this PR is now 20 days old and has been superseded by 20 subsequent daily bump PRs (through PR #65). Current upstream releases have advanced significantly (serialize 1.17.0, reliable 1.4.5, netcode 1.4.8, yojimbo 1.13.5, schema 2.5.0).

Recommendation: HOLD / Close without merging as superseded by the latest bump branch (PR #65), once the packaging fix for yojimbo 1.13.5 is applied.

---

Detailed Verification Evidence

1. 3-Way Merge & Git Status

• Clean merge against origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d).
• Command:

  git merge-tree --write-tree origin/main 823109a36880bde9b41c9ca070f5da82bb8912c5

  Result tree: 1689fc6849d35d3cf345d35c08cade555a015d0e (exit code: 0).
• Diff verification: Strictly isolated to versions.env (+4 / -4 lines).

2. Upstream Release Verification & Staleness

Ran ./scripts/check-releases.sh at commit 823109a36880bde9b41c9ca070f5da82bb8912c5:

• Output:

  serialize: pinned 1.15.0, latest 1.17.0
  reliable: pinned 1.4.1, latest 1.4.5
  netcode: pinned 1.4.4, latest 1.4.8
  yojimbo: pinned 1.11.0, latest 1.13.5
  schema: pinned 2.3.0, latest 2.5.0
  

• Exit code: 1 (all 5 pinned dependencies are behind upstream).
• The PR is superseded by PR Bump package versions to latest upstream releases #65 (bump-versions-20260921).

3. Remote CI Results & Build Implications

In GitHub Actions workflow run 33492576887 (triggered via workflow_dispatch on bump-versions-20260901 at 823109a36880bde9b41c9ca070f5da82bb8912c5):

• autopkgtest-schema: Succeeded (63s, ID 99807260892)
• All 10 matrix build configurations succeeded:
  • build (debian:12, arm64) (1m39s, ID 99807261120)
  • build (debian:12, amd64) (1m45s, ID 99807261171)
  • build (debian:13, arm64) (1m50s, ID 99807261157)
  • build (debian:13, amd64) (1m58s, ID 99807261290)
  • build (ubuntu:22.04, arm64) (1m57s, ID 99807261204)
  • build (ubuntu:22.04, amd64) (2m23s, ID 99807261225)
  • build (ubuntu:24.04, arm64) (1m54s, ID 99807261318)
  • build (ubuntu:24.04, amd64) (2m04s, ID 99807261134)
  • build (ubuntu:26.04, arm64) (1m56s, ID 99807261340)
  • build (ubuntu:26.04, amd64) (3m11s, ID 99807261169)
• Packaging artifacts (debs-* for all 5 distros on amd64 & arm64) were cleanly produced.
• publish job: Exited with failure due to GitHub Pages environment protection rules (Branch "bump-versions-20260901" is not allowed to deploy to github-pages). As documented in build.yml, deployment is reserved for main.
• Note on yojimbo: At YOJIMBO_VERSION=1.11.0, packages/yojimbo/debian/rules built cleanly. The upstream test path break did not occur until 1.13.5.

4. Negative Controls / Red-Tests

• Script sensitivity test:
  • Mutated versions.env locally with SCHEMA_VERSION=0.0.1. ./scripts/check-releases.sh detected the discrepancy immediately, outputting schema: pinned 0.0.1, latest 2.5.0 and exiting with code 1.
  • Ran ./scripts/check-releases.sh --update in the scratch worktree, confirming that updating pinned versions to current upstream releases brings the repository to current state.
  • Re-tested with ./scripts/check-releases.sh, confirming that it outputs all pinned versions are current and exits with code 0.
• Worktree integrity: Confirmed scratch worktree restored to clean detached HEAD state matching 823109a36880bde9b41c9ca070f5da82bb8912c5 (git status --porcelain clean).

---

Conclusion & Disposition

Technically, the commit built and tested successfully on its branch. However, because upstream releases have continued to ship over the intervening 3 weeks, merging PR #45 would publish obsolete packages and trigger immediate subsequent bump PRs.

Recommended action: Close PR #45 as superseded by PR #65.

READ-COST: reader=Emma model=gemini-2.5-pro seconds=257 tokens=unknown plan=max